Recognition of Certification Authorities and Certificates
Under the Electronic Transactions Ordinance ("ETO"), the Government Chief Information Officer ("GCIO") is the authority for granting recognition to certification authorities ("CAs") and to the certificates that recognized CAs issue. Recognition will only be granted to those CAs and digital certificates that meet the trustworthiness standard and other requirements of the Government. Recognition of CAs and certificates is governed under relevant provisions of the ETO.
Recognition as a Recognized CA
- Section 21(4) of the ETO states that in determining whether the applicant is suitable for recognition, the GCIO shall, in addition to any other matter the GCIO considers relevant, take into account the following -
- whether the applicant has the appropriate financial status for operating as a recognized CA in accordance with the ETO and the Code of Practice for Recognized Certification Authorities ("Code of Practice");
- the arrangements put in place or proposed to be put in place by the applicant to cover any liability that may arise from its activities relevant for the purposes of the ETO;
- the system, procedure, security arrangements and standards used or proposed to be used by the applicant to issue certificates to subscribers;
- the report, referred to in section 20(3)(b) of the ETO, which contains an assessment as to whether the applicant is capable of complying with the provisions of the ETO and of the Code of Practice as are specified in the Code of Practice (such provisions are specified under paragraph 1 of Appendix 2 of the Code of Practice); or
the statutory declaration, referred to in section 20(3)(c) of the ETO, which states whether the applicant is capable of complying with the provisions of the ETO and of the Code of Practice as are specified in the Code of Practice (such provisions are specified under paragraph 2 of Appendix 2 of the Code of Practice); - whether the applicant and its responsible officers are fit and proper persons; and
- the reliance limits set or proposed to be set by the applicant for its certificates.
- Regarding the report as referred in section 20(3)(b) of the ETO, a CA applying for recognition must furnish to the GCIO a report containing an assessment as to whether the CA is capable of complying with the provisions of the ETO and of the Code of Practice as are specified in the Code of Practice (such provisions are specified under paragraph 1 of Appendix 2 of the Code of Practice). The report shall be prepared by a person approved by the GCIO as being qualified to make such a report. Qualifications of the person are set out in section 12 of the Code of Practice. A CA shall apply to the GCIO for approval that the person whom the CA intends to engage for the preparation of an assessment report is a qualified person under the ETO, and furnish the GCIO with the
required documents and information in respect of the application. - The validity period for recognition of a CA will normally be three years. The recognized CA may apply to the GCIO for renewal of the recognition.
Recognition of Certificate
- A recognized CA may apply to the GCIO for recognition of some or all of its certificates. If the CA is not yet a recognized CA, the CA shall submit an application for recognition for itself as well as for its certificates. The recognition of the certificates will only be considered after the GCIO has granted recognition to the CA concerned.
- In general, as long as a recognized CA maintains its recognition status, the recognition status of a recognized certificate issued by the recognized CA will not change provided that the relevant certification practice statement ("CPS"), including the relevant certificate policy that governs the recognized certificate, has not materially changed.
- Section 22(5) of the ETO states that for the recognition of a particular certificate or a type, class or description of certificates, the GCIO shall, in addition to any other matter the GCIO considers relevant, take into account the following -
- whether the certificate(s) are issued in accordance with the recognized CA's CPS;
- whether the certificate(s) are issued in accordance with the Code of Practice;
- the reliance limit set or proposed to be set for that particular certificate, or that type, class or description of certificates, as the case may require; and
- the arrangements put in place or proposed to be put in place by the recognized CA to cover any liability that may arise from the issue of that particular certificate, or that type, class or description of certificates, as the case may be.
Application for Recognition
Regarding application for recognition/renewal of recognition as a recognized CA and/or recognition of certificates, please refer to Application for Recognition.
Note:
The information in this web page is not intended to affect your rights and obligations. It is not intended to be relied upon as a statement of the legal position and you should consult your legal adviser before acting upon the information.
