(5) Subject to a three month notice, the certification authority may terminate the agreement for connection to the certification authority.

Another suggestion was that, in dealing with messages certified by a certification authority, the party that designated a given certification authority should bear the risk involved by the use of the certificates issued by that certification authority.

In the case of governmentally authorized certification authorities, the fulfilment of the applicable operation criteria by a certification authority would constitute a prerequisite for the authorization of that certification authority, which, in turn, would be a condition for the recognition of the legal effectiveness of the certificates issued by that certification authority.

(1) An authorized certification authority shall be liable to any person who has acted in good faith in reliance on a certificate issued by the certification authority for any loss due to defects in the registration of the certification authority, technical breakdowns or similar circumstances even if the loss is not due if the loss is due to negligence by the certification authority.

(g) any limitation of the liability of the certification authority

The view was expressed that a party who requested the services of a certification authority should accept to be bound by the terms of a certification practice statement by making use of the services of a certification authority.

(c) the costs of using the services of the certification authority

At the lowest level, the domestic certification authority would merely guarantee the identity of the foreign certification authority, based on a verification of its public key and digital signature.

The Working Group was reminded of its earlier discussion concerning consumer issues and the liability of a certification authority and the possible limitations or exclusions of liability pursuant to national law or the certification authority apos s certification practice statement.

(d) the name, address or place of business of the certification authority

Such notice of termination takes effect when received by the certification authority.

Reservations were expressed, however, about the possibility that a certification authority might avoid liability for its own negligence by virtue of liability exemption clauses or disclaimers contained in the certification practice statement or in any other document issued by that certification authority.

By issuing a certificate, a certification authority represents that it has confirmed that

At the immediately lower level, the domestic certification authority would guarantee the content of a foreign certificate based on the information it had received as to the trustworthiness of the foreign certification authority.

In response to questions concerning a certification authority apos s ability to fulfil such a duty, it was stated that the currently available technology allowed a certification authority to respond quickly in those situations.

(2) The register shall be maintained by the certification authority for at least 10 years after the date of revocation or expiry of the operational period of any certificate issued by that certification authority.

From a technological point of view, certification practice statements could be accessible in electronic form to persons using the services of a certification authority.

(h) any restrictions imposed by the certification authority on the use of the certificate

(4) Where an authorized certification authority has received notice of revocation of a certificate, the authority shall register such revocation forthwith.

A lesser degree of trustworthiness would be reached where the domestic certification authority limited its commitment to guaranteeing the trustworthiness of the foreign certification authority without assuming any liability for the contents of the foreign certificate.

Where the liability of a certification authority was alleged, the certification authority would be presumed to be liable for the consequences of issuing a certificate, unless it could prove that it had met the above mentioned requirements.

The revocation is effective from the time when it is registered received by the certification authority.

(3) The information listed in paragraph (1) shall be delivered to the user before a final agreement of certification is concluded. That information may be delivered by the certification authority by way of a certification practice statement.

(2) Upon request from legal or natural persons, the certification authority shall deliver information about the following

(e) the technical requirements of the certification authority with respect to the user apos s communication equipment

It was stated that the issue of liability of certification authorities involved two different types of liability a structural liability, which resulted from the breach by the certification authority of its terms of operation, and a transactional liability, which resulted from the certification authority apos s actions in issuing, suspending or revoking a certificate.

As between the holder of the private key and the certification authority, it might be appropriate to provide that the revocation should become effective upon receipt by the certification authority of the request for revocation made by the holder of the private key.

Depending on the level of service provided by the certification authority and the method used for filing certificates, it might not be cost effective for a certification authority to undertake to retain some types of certificates beyond a certain period of time.

(1) The ... the enacting State specifies the organ or authority competent for authorizing certification authorities may grant authorization to certification authorities to act in pursuance of this Law these Rules .

The Working Group discussed the definition of authorized certification authority on the basis of the following draft provision

In the second case, the certification authority was in breach of its professional obligations to its own customer.

The Working Group proceeded to consider the circumstances that could excuse a faulty performance by the certification authority.

(1) A certification authority is only allowed to request such information as is necessary to identify the user.

In that connection, it was suggested that the Working Group might give consideration to the possibility of replacing the notion of certification authority by that of certification entity , to avoid the possible implication that functions of certification were necessarily performed by public authorities.

Similarly, a party to a transaction involving the use of a foreign certificate might be satisfied, for instance, with knowing that the certificate had been issued by a reputable foreign certification authority without deeming it necessary to obtain a guarantee from a domestic certification authority.

The certification authority should be expected to disclose its certification practice statement (CPS), apprising the users, inter alia, of the methods and procedures it used for identifying the holder of public key.

(4) Subject to a one month notice, the user may terminate the agreement for connection to the certification authority.

However, the time needed for such a response was not only a function of the technology available, but depended also on the level of service provided by a certification authority to its customers under the terms of their contractual arrangements (e.g., whether the certification authority had designated staff to deal with loss, compromise or misuse of private keys whether the certification authority offered customer services during weekends or only during ordinary office hours).

Under paragraph (2), the organ or authority competent for authorizing certification authorities in the enacting State was given the possibility of recognizing certificates issued by foreign certification authorities under the conditions it stipulated.

Furthermore, the inclusion of any such criteria would make it necessary to identify the entity or authority competent for establishing whether any particular certification authority met the said criteria.

If the certification authority failed to do so, it should be liable for any resulting loss sustained by the user.

(d) the policy or practices of the certification authority with respect to the use, storage and communication of personal information

However, should a certification authority wish to undertake obligations stricter than the above listed representations, it should be allowed to do so, by way of clauses included in a certification practice statement or otherwise.

Under those circumstances, it was asked whether it would be appropriate for the injured party to have direct recourse against the certification authority, or whether the injured party should have a right of redress against its trading partner only, who, in turn, might have recourse against the certification authority.

Limiting the user apos s rights to seeking redress from its trading partner for failures by the certification authority would leave unprotected those persons who were victims of fraudulent acts involving the use of fictitious names or identities with the knowledge or the contributory negligence of the certification authority.