Regulation 18

This regulation applies only to every accredited certification authority which allows subscribers to request for suspension of certificates.

Every accredited certification authority may provide for immediate revocation instead of suspension if the subscriber has agreed in writing.

Upon receiving a request for suspension of a certificate under paragraph 16 of the Third Schedule to the Act, the accredited certification authority must ensure that the certificate is suspended and notice of the suspension published in the repository in accordance with paragraph 19 of the Third Schedule to the Act.

An accredited certification authority may suspend a certificate that it has issued if the accredited certification authority has reasonable grounds to believe that the certificate is unreliable, regardless of whether the subscriber consents to the suspension; but the accredited certification authority must complete its investigation into the reliability of the certificate and decide within a reasonable time whether to reinstate the certificate or to revoke the certificate in accordance with paragraph 17 or 18 of the Third Schedule to the Act.

It is the responsibility of any person relying on a certificate to check whether a certificate has been suspended.

An accredited certification authority must suspend a certificate after receiving a valid request for suspension (in accordance with paragraph 16 of the Third Schedule to the Act); but if the accredited certification authority considers that revocation is justified in the light of all the evidence available to it, the certificate must be revoked in accordance with paragraph 17 or 18 of the Third Schedule to the Act.

An accredited certification authority must check with the subscriber or his or her authorised agent whether the certificate should be revoked and whether to reinstate the certificate after suspension.

An accredited certification authority must terminate a suspension initiated by request if the accredited certification authority discovers and confirms that the request for suspension was made without authorisation by the subscriber or his or her authorised agent.

If the suspension of a certificate leads to a revocation of the certificate, the requirements for revocation apply.

The date and time of all transactions in relation to the suspension of certificates must be logged and kept in a trustworthy manner.

An accredited certification authority must maintain facilities to receive and act upon requests for suspension at all times of the day and on all days of every year.