Form For Application For Grant of Licence To Be A Certifying Authority
Form For Application For Grant of Licence To Be A Certifying Authority
11. Fee.- (1) The application for the grant of a licence shall be accompanied by a
non-refundable fee of twenty-five thousand rupees payable by a bank draft or by a
pay order drawn in the name of the Controller.
(2) The application submitted to the Controller for renewal of Certifying
Authority’s licence shall be accompanied by a non-refundable fee of five thousand
rupees payable by a bank draft or by a pay order drawn in the name of the
Controller.
(3) Fee or any part thereof shall not be refunded if the licence is suspended or
revoked during its validity period.
12. Cross Certification.- (1) The licensed Certifying Authority shall have
arrangement for cross certification with other licensed Certifying Authorities within
India which shall be submitted to the Controller before the commencement of their
operations as per rule 20:
Provided that any dispute arising as a result of any such arrangement
between the Certifying Authorities; or between Certifying Authorities or Certifying
Authority and the Subscriber, shall be referred to the Controller for arbitration or
resolution.
(2) The arrangement for Cross Certification by the licensed Certifying
Authority with a Foreign Certifying Authority along with the application, shall be
submitted to the Controller in such form and in such manner as may be provided in
the regulations made by the Controller; and the licensed Certifying Authority shall not
commence cross certification operations unless it has obtained the written or digital
signature approval from the Controller.
13. Validity of licence.- (1) A licence shall be valid for a period of five years from the
date of its issue.
(2) The licence shall not be transferable.
14. Suspension of Licence.- (1) The Controller may by order suspend the licence in
accordance with the provisions contained in sub-section (2) of section 25 of the Act.
(2) The licence granted to the persons referred to in clauses (a) to (c) of sub-rule (1) of
rule 8 shall stand suspended when the performance bond submitted or the banker’s guarantee
furnished by such persons is invoked under sub-rule (2) of that rule.
15. Renewal of licence.- (1) The provisions of rule 8 to rule 13, shall apply in the case
of an application for renewal of a licence as it applies to a fresh application for licensed
Certifying Authority.
(2) A Certifying Authority shall submit an application for the renewal of its
licence not less than forty-five days before the date of expiry of the period of validity
of licence.
(3) The application for renewal of licence may be submitted in the form of
electronic record subject to such requirements as the Controller may deem fit.
16. Issuance of Licence.- (1) The Controller may, within four weeks from the
date of receipt of the application, after considering the documents accompanying the
application and such other factors, as he may deem fit, grant or renew the licence or
reject the application:
(2) If the application for licensed Certifying Authority is approved, the applicant
shall -
(a) submit a performance bond or furnish a banker’s
guarantee within one month from the date of such approval to the
Controller in accordance with sub-rule (2) of rule 8; and
(b) execute an agreement with the Controller binding
himself to comply with the terms and conditions of the licence and the
provisions of the Act and the rules made thereunder.
17. Refusal of Licence.- The Controller may refuse to grant or renew a licence
if-
(i) the applicant has not provided the Controller with such
information relating to its business, and to any circumstances likely to
affect its method of conducting business, as the Controller may require;
or
(ii) the applicant is in the course of being wound up or liquidated; or
(iii) a receiver has, or a receiver and manager have, been appointed
by the court in respect of the applicant; or
(iv) the applicant or any trusted person has been convicted, whether
in India or out of India, of an offence the conviction for which involved a
finding that it or such trusted person acted fraudulently or dishonestly, or
has been convicted of an offence under the Act or these rules; or
(v) the Controller has invoked performance bond or banker’s
guarantee; or
(vi) a Certifying Authority commits breach of, or fails to observe and
comply with, the procedures and practices as per the Certification
Practice Statement; or
(vii) a Certifying Authority fails to conduct, or does not submit, the
returns of the audit in accordance with rule 31; or
(viii) the audit report recommends that the Certifying Authority is not
worthy of continuing Certifying Authority’s operation; or
(ix) a Certifying Authority fails to comply with the directions of the
Controller.
(2) The Certifying Authority shall formulate its Information Technology and
Security Policy for operation complying with these guidelines and submit it to the
Controller before commencement of operation:
Provided that any change made by the Certifying Authority in the Information
Technology and Security Policy shall be submitted by it within two weeks to the
Controller.
20. Commencement of Operation by Licensed Certifying Authorities.- The
licensed Certifying Authority shall commence its commercial operation of generation
and issue of Digital Signature only after -
(a) it has confirmed to the Controller the adoption of Certification Practice
Statement;
(b) it has generated its key pair, namely, private and corresponding public
key, and submitted the public key to the Controller;
(b) the installed facilities and infrastructure associated with all functions
of generation, issue and management of Digital Signature Certificate have
been audited by the accredited auditor in accordance with the provisions of
rule 31; and
(c) it has submitted the arrangement for cross certification with other
licensed Certifying Authorities within India to the Controller.
(a) give notice to the Controller of its intention to cease acting as a Certifying
Authority:
Provided that the notice shall be made ninety days before ceasing to act as
a Certifying Authority or ninety days before the date of expiry of licence;
(b) advertise sixty days before the expiry of licence or ceasing to act as
Certifying Authority, as the case may be, the intention in such daily newspaper
or newspapers and in such manner as the Controller may determine;
(c) notify its intention to cease acting as a Certifying Authority to the
subscriber and Cross Certifying Authority of each unrevoked or unexpired
Digital Signature Certificate issued by it :
Provided that the notice shall be given sixty days before ceasing
to act as a Certifying Authority or sixty days before the date of expiry of
unrevoked or unexpired Digital Signature Certificate, as the case may be;
(d) the notice shall be sent to the Controller, affected subscribers and
Cross Certifying Authorities by digitally signed e-mail and registered post;
(e) revoke all Digital Signature Certificates that remain unrevoked or
unexpired at the end of the ninety days notice period, whether or not the
subscribers have requested revocation;
(f) make a reasonable effort to ensure that discontinuing its certification
services causes minimal disruption to its subscribers and to persons duly
needing to verify digital signatures by reference to the public keys contained in
outstanding Digital Signature Certificates;
(g) make reasonable arrangements for preserving the records for a period
of seven years;
(h) pay reasonable restitution (not exceeding the cost involved in obtaining
the new Digital Signature Certificate) to subscribers for revoking the Digital
Signature Certificates before the date of expiry;
(i) after the date of expiry mentioned in the licence, the Certifying
Authority shall destroy the certificate–signing private key and confirm the date
and time of destruction of the private key to the Controller.
(2) The period for which a Digital Signature Certificate has been issued shall not
be extended, but a new Digital Signature Certificate may be issued after the expiry of
such period.
(2) The revoked Digital Signature Certificate shall be added to the Certificate
Revocation List (CRL).
30. Fees for issue of Digital Signature Certificate.- (1) The Certifying Authority
shall charge such fee for the issue of Digital Signature Certificate as may be
prescribed by the Central Government under sub-section (2) of section 35 of the Act.
(2) Fee may be payable in respect of access to Certifying Authority’s X.500
directory for certificate downloading. Where fees are payable, Certifying Authority
shall provide an up-to-date fee schedule to all its subscribers and users, this may be
done by publishing fee schedule on a nominated website.
(3) Fees may be payable in respect of access to Certifying Authority’s X.500
directory service for certificate revocation or status information. Where fees are
payable, Certifying Authority shall provide an up-to-date fee schedule to all its
subscribers and users, this may be done by publishing the fee schedule on a
nominated website.
(4) No fee is to be levied for access to Certification Practice Statement via
Internet. A fee may be charged by the Certifying Authority for providing printed
copies of its Certification Practice Statement.
31. Audit.- (1) The Certifying Authority shall get its operations audited annually
by an auditor and such audit shall include inter alia,-
(i) security policy and planning;
(ii) physical security;
(iii) technology evaluation;
(iv) Certifying Authority’s services administration;
(v) relevant Certification Practice Statement;
(vi) compliance to relevant Certification Practice Statement;
(vii) contracts/agreements;
(viii) regulations prescribed by the Controller;
(ix) policy requirements of Certifying Authorities Rules, 2000.
(3) The Certifying Authority shall submit copy of each audit report to the Controller
within four weeks of the completion of such audit and where irregularities are found, the
Certifying Authority shall take immediate appropriate action to remove such irregularities.
32. Auditor’s relationship with Certifying Authority.- (1) The auditor shall be
independent of the Certifying Authority being audited and shall not be a software or
hardware vendor which is, or has been providing services or supplying equipment to
the said Certifying Authority.
(2) The auditor and the Certifying Authority shall not have any current or
planned financial, legal or other relationship, other than that of an auditor and the
audited party.
For Individual
1. Full Name *
Last Name/Surname __________________________________
First Name ___________________________________
Middle Name ___________________________________
3. Address
A. Residential Address *
Flat/Door/Block No. ___________________________________
Name of Premises/Building/Village ___________________________________
Road/Street/Lane/Post Office ___________________________________
Area/Locality/Taluka/Sub-Division ___________________________________
Town/City/District ___________________________________
State/Union Territory __________________ Pin : __________
Telephone No. ___________________________________
Fax ___________________________________
Mobile Phone No. ___________________________________
B. Office Address *
Name of Office ___________________________________
Flat/Door/Block No. ___________________________________
Name of Premises/Building/Village ___________________________________
Road/Street/Lane/Post Office ___________________________________
Area/Locality/Taluka/Sub-Division ___________________________________
Town/City/District ___________________________________
State/Union Territory __________________ Pin : __________
Telephone No. ___________________________________
Fax ___________________________________
4. Address for Communication * Tick as applicable A or B
5. Father’s Name *
Last Name/Surname __________________________________
First Name ___________________________________
Middle Name ___________________________________
8. Nationality * ___________________________________
26. Names, Addresses etc. of Partners/Members/Directors (For Information about more persons,
please add separate sheet(s) in the format given in the next page) *
Details of Partners/Members/Directors
A. Full Name
Last Name/Surname __________________________________
First Name ___________________________________
Middle Name ___________________________________
B. Address
Flat/Door/Block No. ________________________________
Name of Premises/Building/Village ________________________________
Road/Street/Lane/Post Office ________________________________
Area/Locality/Taluka/Sub-Division ________________________________
Town/City/District ________________________________
State/Union Territory Pin ________________________________
Telephone No. ________________________________
Fax No. ________________________________
Mobile Phone No. ________________________________
C. Nationality ________________________________
In case of foreign national, Visa details_______________________________
D. Passport Details #
Passport No. ___________________________________
Passport issuing authority ___________________________________
Passport expiry date ___________________________________
E. Voter’s Identity Card No. # ___________________________________
F. Income Tax PAN no. # ___________________________________
G. E-mail Address ___________________________________
H. Personal Web page URL, if any ___________________________________
30. Whether bank draft/pay order for licence fee enclosed * : Y / N If yes,
Name of Bank ________________________________
Draft/pay order No. ________________________________
Date of Issue ________________________________
Amount ________________________________
_____________________________________________________________________________
Instructions : 1. Columns marked with * are mandatory.
2. For the columns marked with #, details for at least one is mandatory.
3. Column No. 1 to 17 are to be filled up by individual applicant.
4. Column No. 18 to 27 are to be filled up if applicant is a Company/ Firm/ Body of
Individuals/ Association of Persons/ Local Authority.
5. Column No. 28 is to be filled up if applicant is a Government organisation.
6. Column No. , 29, 30, 31 and 34 are to be filled up by all applicants.
@
7. Column No. 32 is applicable only for application for renewal of licence.
8. Column No. 33 is not applicable if the applicant is a Government organisation.