Introduction

The Information Technology Act, 2000 was enacted by the Indian Parliament in June, 2000. It was notified for implementation in October, 2000 with the issuance of Rules under the Act. The purpose of the Act is to promote the use of digital signatures for the growth of E-Commerce and E-Governance. It provides legal recognition to electronic records, and puts digital signatures at par with handwritten signatures. The Act defines the legal and administrative framework for the creation of Public Key Infrastructure (PKI) in the country to generate trust in electronic environment. To help establish PKI in the country and ensure interoperability among all Certifying Authorities, technical standards have been framed in Rules and Regulations under the Act. Electronic authentication of individuals, businesses and other entities, as also secure communication of messages over the Internet and any open networks are the aims of the PKI. The Controller of Certifying Authorities (CCA) has been appointed by the Central Government under section 17 of the Act for purposes of the IT Act. The Office of the CCA came into existence on November 1, 2000. It aims at promoting the growth of E-Commerce and E-Governance through the wide use of digital signatures.

The CCA has to license Certifying Authorities (CAs) and exercise supervision over their activities. It is required to certify the public keys of the CAs, as also lay down the standards to be maintained by the CAs, and perform several other functions under section 18 of the Act to regulate the functioning of CAs in the country. It is also required to issue licenses to CAs by signing/certifying their public keys, i.e. signing their Digital Signature Certificates more commonly known as Public Key Certificates (PKCs). The Certification Practice Statement (CPS) of the Controller of Certifying Authorities has been prepared to address the issues related to the licensing process and other relevant topics such as certificate policy, issuance and cancellation of licenses, security control and operational policy & procedures and other matters relevant to obligations and responsibilities of the CCA and CAs in accordance with the IT Act, Rules and Regulations.

This CPS uses certain expressions. These are given below. Their definitions are as given in the IT Act, Rules and Regulations:

 Applicant

Licensed Certifying Authority (CA)
means a person or organization who has been granted a License to issue Digital Signature Certificates under Section 24 of the IT Act, 2000

Information Technology Act, 2000 (IT Act, 2000)
means the Act to provide legal recognition for transactions carried out by means of electronic data interchange and other means of electronic communication, commonly referred to as "electronic commerce" which involve the use of alternatives to paper based methods of communication and storage of information, to facilitate electronic filing of documents with the Government agencies.

National Repository of Digital Certificates (NRDC)
means the repository of all Digital Signature Certificates issued under the IT Act, 2000.

Root Certifying Authority of India (RCAI) is the Root CA operated by the CCA that certifies the public keys of all CAs in India.

Certification Practice Statement (CPS) means the statement issued by a Certifying Authority to specify the practices that the Certifying Authority employs in issuing Digital Signature Certificates, in accordance with the Guideline No. 1(6)/2001-CCA dated July 9, 2001.

Controller means the Controller of Certifying Authorities appointed under sub-section (1) of section 17 of the IT Act, 2000.

Office of Controller of Certifying Authorities (CCA) means the Office of the Controller appointed under section 17(1) of the IT Act, 2000.

Cyber Appellate Tribunal means the Cyber Regulation Appellate Tribunal established under sub-section (1) of section 48 of IT Act, 2000.

Digital Signature means authentication of any electronic record by a subscriber by means of an electronic method or procedure in accordance with the provisions of section 3 of the IT Act, 2000.

Digital Signature Certificate (DSC) means a Digital Signature Certificate issued under sub-section (4) of section 35 of the IT Act, 2000.

License means a License granted to a Certifying Authority under section 24 of the IT Act, 2000.