Section 36 of IT Act 2000: Representations upon issuance of Digital Signature Certificate

A Certifying Authority while issuing a Digital Signature Certificate shall certify that—

(a) it has complied with the provisions of this Act and the rules and regulations made thereunder;

(b) it has published the Digital Signature Certificate or otherwise made it available to such person relying on it and the subscriber has accepted it;

(c) the subscriber holds the private key corresponding to the public key, listed in the Digital Signature Certificate;

(ca) the subscriber holds a private key which is capable of creating a digital signature;

(cb) the public key to be listed in the certificate can be used to verify a digital signature affixed by the private key held by the subscriber;

(d) the subscriber’s public key and private key constitute a functioning key pair;

(e) the information contained in the Digital Signature Certificate is accurate; and

(f) it has no knowledge of any material fact, which if it had been included in the Digital Signature Certificate would adversely affect the reliability of the representations in clauses (a) to (d).

Explained:

Section 36 requires a Certifying Authority to provide specific assurances when issuing a Digital Signature Certificate. These assurances are important because individuals and organisations rely on certificates to verify electronic signatures and authenticate digital transactions.

Clause (a): Compliance with the Information Technology Act, 2000

Clause (a) requires the Certifying Authority to certify that it has complied with the provisions of the Information Technology Act, 2000, and the rules and regulations made under it.

This means that a Certifying Authority cannot issue certificates without following the applicable statutory and regulatory requirements. It must operate within the legal framework governing electronic signature certificates.

For example, an authorised Certifying Authority issuing a Digital Signature Certificate must follow the applicable procedures, security standards and regulatory conditions.

Clause (b): Publication and Acceptance of Digital Signature Certificate

Clause (b) requires the Certifying Authority to publish the Digital Signature Certificate or otherwise make it available to persons relying on it. It also requires the subscriber to have accepted the certificate.

Publication or availability enables interested parties to access the certificate and verify relevant information. Acceptance indicates that the subscriber has approved the certificate and its associated information.

This requirement promotes transparency and helps establish trust between the subscriber, Certifying Authority and persons relying on the certificate.

Clause (c): Possession of the Corresponding Private Key

Clause (c) requires the Certifying Authority to certify that the subscriber holds the private key corresponding to the public key listed in the Digital Signature Certificate.

Digital signature technology generally uses two related cryptographic keys:

• Private key: Used by the subscriber to create a digital signature.
• Public key: Used by others to verify the digital signature.

The connection between these keys is essential for authenticating electronically signed documents. If the subscriber does not hold the corresponding private key, the reliability of the certificate may be affected.

Clause (ca): Private Key Capable of Creating a Digital Signature

Clause (ca) was introduced through the Information Technology (Amendment) Act, 2008.

It specifically requires the subscriber to hold a private key capable of creating a digital signature.

The purpose is to ensure that the private key associated with the certificate is technically capable of performing its intended function. Merely possessing a key is not sufficient if it cannot generate the required digital signature.

Clause (cb): Verification of Digital Signature Through the Public Key

Clause (cb) requires the public key listed in the certificate to be capable of verifying a digital signature created using the subscriber’s private key.

This establishes the relationship between the private key used for signing and the public key used for verification.

For example, when a company electronically signs an official document, the recipient can use the corresponding public key to verify whether the digital signature is valid and whether the document has been altered after signing.

Clause (d): Functioning Public and Private Key Pair

Clause (d) requires the subscriber’s public key and private key to constitute a functioning key pair.

Both keys must work together according to the relevant cryptographic system. This requirement is important because a mismatch or technical failure between the keys may prevent successful verification.

It therefore provides an additional assurance regarding the technical reliability of the Digital Signature Certificate.

Clause (e): Accuracy of Information Contained in the Certificate

Clause (e) requires the Certifying Authority to certify that the information contained in the Digital Signature Certificate is accurate.

The information in a certificate is important for identifying the subscriber and establishing the reliability of the electronic signature.

Incorrect identity details or other material inaccuracies may create difficulties in verifying electronic documents and determining the person responsible for signing them.

Clause (f): Disclosure of Material Facts Affecting Reliability

Clause (f) requires the Certifying Authority to certify that it has no knowledge of any material fact which, if included in the certificate, would adversely affect the reliability of the representations made under clauses (a) to (d).

This provision promotes transparency and responsible certificate issuance.

A Certifying Authority should not knowingly withhold important information that could affect the trustworthiness of a certificate. It helps protect individuals and organisations who rely on Digital Signature Certificates for electronic transactions.

Importance of Section 36 in Digital Transactions

Section 36 plays an important role in maintaining confidence in India’s electronic authentication system. Its requirements are relevant in several practical situations.

1. Online business transactions: Companies use Digital Signature Certificates for electronic agreements, corporate filings and other authorised business activities. The representations under Section 36 help establish confidence in the certificates used for these transactions.

2. Government e-filing: Digital signatures are commonly used in authorised government filing systems, including income tax and corporate compliance platforms. Reliable certificates help authenticate the identity of the person submitting documents.

3. Banking and financial transactions: Digital authentication mechanisms help protect electronic transactions and establish accountability. Certificate reliability is particularly important where financial documents and approvals are digitally signed.

4. Prevention of digital fraud: The requirements concerning private keys, public keys and accurate certificate information help reduce the risks of impersonation, unauthorised signing and misuse of electronic credentials.

5. Verification of electronic documents: The public-key verification process enables recipients to check the authenticity of a digital signature and identify possible changes to a signed electronic document.

Important Judgments

Section 36 deals with technical and statutory representations made by Certifying Authorities. Reported judicial decisions directly interpreting its individual clauses are limited. The following judgments are relevant to the broader legal framework of electronic transactions and electronic records, rather than direct interpretations of Section 36.

1. Trimex International FZE Ltd. v. Vedanta Aluminium Ltd. (2010)

The Supreme Court examined whether contractual negotiations conducted through email communications could result in a legally binding agreement.

The Court recognised that a contract can be concluded through electronic communications when the essential elements of a valid agreement are established.

Relevance: The judgment demonstrates the legal importance of electronic communications in commercial transactions. Section 36 complements the broader digital transaction framework by establishing assurances concerning Digital Signature Certificates.

2. Anvar P.V. v. P.K. Basheer (2014)

The Supreme Court considered the admissibility of electronic records under Section 65B of the Indian Evidence Act, 1872.

The judgment clarified the importance of complying with statutory requirements when electronic records are produced as evidence.

Relevance: A Digital Signature Certificate may help establish the authenticity of an electronic document, but its issuance does not automatically satisfy every requirement for admitting that document in court.

3. Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020)

The Supreme Court clarified the requirements relating to certificates for electronic evidence under Section 65B of the Indian Evidence Act, 1872.

Relevance: The decision highlights the importance of reliable electronic records and proper evidentiary procedures. It is useful when digitally signed documents are relied upon in legal proceedings, although it does not directly interpret Section 36.

The Bharatiya Sakshya Adhiniyam, 2023, replaced the Indian Evidence Act with effect from 1 July 2024. Therefore, the applicable evidentiary provisions must be considered according to the date and circumstances of the proceeding.

Relationship Between Sections 35, 36, 37 and 38

Understanding Section 36 becomes easier when it is read alongside the neighbouring provisions of the Information Technology Act, 2000.

These provisions collectively establish the legal framework for issuing, maintaining, suspending and revoking electronic signature certificates.

Conclusion

Section 36 of the Information Technology Act, 2000, is an important provision for ensuring the reliability and authenticity of Digital Signature Certificates in India. It places specific responsibilities on Certifying Authorities to verify statutory compliance, ensure the availability and acceptance of certificates, establish the relationship between public and private keys, and maintain accurate certificate information.

The provision strengthens confidence in electronic authentication by requiring Certifying Authorities to make legally significant representations when issuing certificates.