40. Where any Digital Signature Certificate, the public key of which corresponds to the private key of that subscriber which is to be listed in the Digital Signature Certificate has been accepted by a subscriber, then, the subscriber shall generate the key pair by applying the security procedure. =============... ... ...

39. (1) Where a Digital Signature Certificate is suspended or revoked under section 37 or section 38, the Certifying Authority shall publish a notice of such suspension or revocation, as the case may be, in the repository specified in the Digital Signature Certificate for publication of such notice. (2) Where one or more repositories are specified, the Certifying Authority shall publish notices of such suspension or revocation, as the case may he. in all such repositories. ============... ... ...

38. (1) A Certifying Authority may revoke a Digital Signature Certificate issued by it- (a) where the subscriber or any other person authorised by him makes a request to that effect; or (b) upon the death of the subscriber, or (c) upon the dissolution of the firm or winding up of the company where the subscriber is a firm or a company. (2) Subject to the provisions of sub-section (3) and without prejudice to the provisions of sub-section (1), a Certifying Author... ... ...

37. (1) Subject to the provisions of sub-section (2), the Certifying Authority which has issued a Digital Signature Certificate may suspend such Digital Signature Certificate,- (a) on receipt of a request to that effect from- (i) the subscriber listed in toe Digital Signature Certificate; or (ii) any person duly authorised to act on behalf of that subscriber, (b) if it is of opinion that the Digital Signature Certificate should be suspended in public inter... ... ...

A Certifying Authority issuing a Digital Signature Certificate must certify compliance with the Act and rules and regulations, certificate availability to a relying person, and subscriber acceptance. It must confirm that the subscriber holds the corresponding private key, the public and private keys form a functioning key pair, and certificate information is accurate. It must also lack knowledge of material facts adversely affecting the reliability of these representations.

Applications for a Digital Signature Certificate must be made in the prescribed form, with the prescribed fee and a certification practice statement or other required statement. Issuance depends on verification that the applicant holds a functional private key corresponding to the listed public key and that the public key can verify signatures created by that private key. Rejection requires recorded reasons and a reasonable opportunity for the applicant to show cause.

Certifying Authorities must disclose their Digital Signature Certificate and corresponding public key, relevant certification practice statement, revocation or suspension of their certificate, and material adverse facts affecting issued certificates or service capability. Where an event may adversely affect computer-system integrity or conditions governing a Digital Signature Certificate, they must reasonably notify affected persons or follow the procedure in their certification practice statement.

Section 33 requires every Certifying Authority whose licence is suspended or revoked to immediately surrender the licence to the Controller. Failure to do so constitutes an offence by the person in whose favour the licence was issued, punishable by imprisonment for up to six months, a fine up to ten thousand rupees, or both.

32. Every Certifying Authority shall display its licence at a conspicuous place of the premises in which it carries on its business. =============... ... ...

31. Every Certifying Authority shall ensure that every person employed or otherwise engaged by it complies, in the course of his employment or engagement, with the provisions of this Act, rules, regulations and orders made thereunder. =============... ... ...

30. Every Certifying Authority shall, - (a) make use of hardware, software and procedures that are secure from intrusion and misuse; (b) provide a reasonable level of reliability in its services which are reasonably suited to the performance of intended functions; (c) adhere to security procedures to ensure that the secrecy and privacy of the digital signatures are assured; and (d) observe such other standards as may be specified by regulations. =======... ... ...

29. (1) Without prejudice to the provisions of sub-section (1) of section 69, the Controller or any person authorised by him shall, if he has reasonable cause to suspect that any contravention of the provisions of this Act, rules or regulations made thereunder has been committed, have access to any computer system, any apparatus, data or any other material connected with such system, for the purpose of searching or causing a search to be made for obtaining any information or data contained i... ... ...

28. (1) The Controller or any officer authorised by him in this behalf shall take up for investigation any contravention of the provisions of this Act, rules or regulations made thereunder. (2) The Controller or any officer authorised by him in this behalf shall exercise the like powers which are conferred on Income-tax authorities under Chapter XIII of the Income-tax Act, 1961 and shall exercise such powers, subject to such limitations laid down under that Act. =============... ... ...

27. The Controller may, in writing, authorise the Deputy Controller, Assistant Controller or any officer to exercise any of the powers of the Controller under this Chapter. =============... ... ...

26. (1) Where the licence of the Certifying Authority is suspended or revoked, the Controller shall publish notice of such suspension or revocation, as the case may be, in the database maintained by him. (2) Where one or more repositories are specified, the Controller shall publish notices of such suspension or revocation, as the case may be, in all such repositories: Provided that the data base containing the notice of such suspension or revocation, as the case may be, shall be made a... ... ...

25. (1) The Controller may, if he is satisfied after making such inquiry, as he may think fit, that a Certifying Authority has,- (a) made a statement in, or in relation to, the application for the issue or renewal of the licence, which is incorrect or false in material particulars; (b) failed to comply with the terms and conditions subject to which the licence was granted; (c) failed to maintain the standards specified under clause (b) of sub-section (2) of section... ... ...

24. The Controller may, on receipt of an application under sub-section (1) of section 21, after considering the documents accompanying the application and such other factors, as he deems fit, grant the licence or reject the application: Provided that no application shall be rejected under this section unless the applicant has been given a reasonable opportunity of presenting his case. =============... ... ...

23. An application for renewal of a licence shall be- (a) in such form; (b) accompanied by such fees, not exceeding five thousand rupees, as may be prescribed by the Central Government and shall be made not less than forty-five days before the date of expiry of the period of validity of the licence. =============... ... ...

22. (1) Every application for issue of a licence shall be in such form as may be prescribed by the Central Government. (2) Every application for issue of a licence shall be accompanied by- (a) a certification practice statement; (b) a statement including the procedures with respect to identification of the applicant; (c) payment of such fees, not exceeding twenty-five thousand rupees as may be prescribed by the Central Government; (d) such other documen... ... ...

21. (1) Subject to the provisions of sub-section (2), any person may make an application, to the Controller, for a licence to issue Digital Signature Certificates. (2) No licence shall be issued under sub-section (1), unless the applicant fulfills such requirements with respect to qualification, expertise, manpower, financial resources and other infrastructure facilities, which are necessary to issue Digital Signature Certificates as may be prescribed by the Central Government (3) A li... ... ...