Regulation 16

In addition to the requirements specified in paragraph 14 of the Third Schedule to the Act, every accredited certification authority must comply with the requirements in this regulation in relation to the issuance of certificates.

The certificate must contain or incorporate by reference information that is sufficient to locate or identify one or more repositories in which notification of the suspension or revocation of the certificate will be listed if the certificate is suspended or revoked.

The practices and procedures set forth in the certification practice statement of an accredited certification authority must contain conditions with standards higher than those conditions specified in paragraph 14(2) of the Third Schedule to the Act.

The subscriber identity verification method employed for issuance of certificates must be specified in the certification practice statement and is subject to the approval of the Controller during the application for accreditation.

Where a certificate is issued to a person (called in this regulation the new certificate) on the basis of another valid certificate held by the same person (called in this regulation the originating certificate) and subsequently the originating certificate has been suspended or revoked, the certification authority that issued the new certificate must conduct investigations to determine whether it is necessary to suspend or revoke the new certificate.

The accredited certification authority must provide a reasonable opportunity for the subscriber to verify the contents of the certificate before it is accepted.

If the subscriber accepts the issued certificate, the accredited certification authority must publish a signed copy of the certificate in a repository mentioned in paragraph (2).

Despite paragraph (7), the accredited certification authority may contractually agree with the subscriber not to publish the certificate.

If the subscriber does not accept the certificate, the accredited certification authority must not publish it.

Once the certificate has been issued by the accredited certification authority and accepted by the subscriber, the accredited certification authority must notify the subscriber within a reasonable time of any fact known to the accredited certification authority that significantly affects the validity or reliability of the certificate.

The date and time of all transactions in relation to the issuance of a certificate must be logged and kept in a trustworthy manner.