Regulation 21

Every accredited certification authority must use the Internet draft of the Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework, adopted by the Internet Engineering Task Force and reproduced by the Controller on its Internet website, as a guide for the preparation of its certification practice statement.

Any change to the certification practice statement during the term of the accreditation requires the prior approval of the Controller.

Every accredited certification authority must highlight to its subscribers any limitation of their liabilities and, in particular, it must draw the subscribers’ attention to the implication of reliance limits on their certificates.

The subscriber identity verification method for the issuance, renewal, suspension and revocation of a certificate must be specified in the certification practice statement.

A copy of the latest version of the certification practice statement, together with its effective date, must be filed with the Controller and published on the certification authority’s Internet website accessible to members of the public.

After the effective date, the latest version filed with the Controller will be the prevailing version for a particular certificate.

Every accredited certification authority must log all changes to the certification practice statement together with the effective date of each change.

An accredited certification authority must keep in a trustworthy manner a copy of each version of the certification practice statement, together with the date it came into effect and the date it ceased to have effect.