Chương III Nghị định 130/2018/NĐ-CP: Dịch vụ chứng thực chữ ký số công cộng

Chapter III

PUBLIC AUTHENTICATION OF DIGITAL SIGNATURES

Section 1: LICENSING OF PUBLIC AUTHENTICATION OF DIGITAL SIGNATURES

Article 11. Operating conditions

Public certification authorities are entitled to provide service if they meet the following conditions:

1. Having the licenses to public authentication of digital signatures granted by the Ministry of Post and Telecommunications.

2. Having digital certificates granted by Root Certification Authority.

Article 12. Validity period

Licenses granted to public certification authorities are valid for 10 years.

Article 13. Licensing conditions

1. Condition for license holder:

Being enterprises established under the laws of Vietnam.

2. Financial condition:

a) Depositing at a commercial bank operating in Vietnam of no less than VND 05 (five) billion to solve risks and the compensation that may occur during the course of service by a cause for which the public certification authority is responsible and make payment for expenses receiving and maintaining database of enterprises in the event of revocation of licenses.

b) Pay full maintenance fees (in case of replacement of license).

3. Condition of personnel:

a) The certification authority must have staff responsible for: administration and operation of the system and issuance of digital certificates, maintenance of information security of the system;

b) The staff prescribed in Point a of this Clause must hold a bachelor's degree or higher, majoring information security or information technology or electrical communication.

4. Technical condition:

a) Formulation of technical equipment system must ensure the following requirements:

- Storing fully, accurately and updating information of subscribers for the issuance of the digital certificates during the valid duration of digital certificates;

- Storing fully, accurately and updating list of digital certificates which are valid, suspended and invalid and allowing and guiding Internet users to access online 24 hours per day and seven days per week;

- Making sure that the creation of the key pair only allows each key pair to be generated randomly and one time; ensures that the private key is not be detected when having the respective public key;

- Having ability to alert, prevent and detect any illegal access in the network environment;

- Designed in the manner that minimizes reduction of the direct contact with the Internet environment;

- Key distribution system for subscribers must ensure the integrity and security of the key pair.  In the case of key distribution through a computer network environment, the key distribution system must be used the security protocols to ensure the confidentiality of information on the transmission line.

b) Having feasible technical plans meeting requirements for information security and technical regulations and mandatory standards on digital signatures and authentication of digital signatures in force;

c) Having plans to control the entrance and exit of head offices, the right to access the system, right to enter, exit the place where the equipment is located for providing authentication of digital signatures;

d) Having contingency plans to maintain the continuous and safe operation, and deal with incidents when they occur;

dd) Having plans to provide information about subscribers online for Root Certification Authority, serving state management of authentication of digital signatures;

e) The entire system of equipment for service provision is located in Vietnam;

g) Construction of offices, places where the machinery and equipment is located in accordance with the requirements of the law on prevention and combat of fire and explosion; having ability of fighting against floods, earthquakes, electromagnetic interference, illegal intrusion of man;

h) Having authentication regulations made according to the form prescribed in authentication regulation of Root Certification Authority.

Article 14. License application dossiers

1. An application for licensing public authentication of digital signatures using form No. 01 in Appendix issued herewith.

2. Certificate of deposit made by a commercial bank operating in Vietnam. This certificate of deposit must include, but not limited to, unconditional and irrevocable clauses of payment to the receiver of the deposit any sum of money within the deposit limit to deal with risks and compensation that may occur during the course of service by a cause for which the public certification authority is responsible  and make payment for expenses receiving and maintaining database of the certification authority in the event of revocation of the license.

3. Personnel dossier includes: Curriculum vitae, degrees and certificates of technical staff engaging in authentication of digital signatures that meet conditions prescribed in Clause 2 Article 13 of this Decree.

4. The technical plan in compliance with Clause 4 Article 13 of this Decree.

5. Authentication regulation made according to the form prescribed in authentication regulation of Root Certification Authority.

Article 15. Verification and licensing

Within 50 working days from the date of receipt of valid application dossier, the Ministry of Post and Telecommunications shall take charge and cooperate with the Ministry of Public Security, Government Cipher Committee and the concerned ministries, branches to verify dossier and issue a license to the applicant if it meets licensing conditions prescribed in Article 13 of this Decree. A license to provide public authentication of digital signatures is stipulated in form No. 05 in Appendix issued herewith.

In case of refusal, the Ministry of Information and Communications shall give a notice and provide explanation.

Article 16. Change of content of the license and license reissuance

1. The content of the license shall be changed if one of the following changes: legal representative, headquarters address, business name.

The license holder shall submit an application for changing content of license to the Ministry of Information and Communications. An application dossier for changing content of license includes: An application for changing content of license using Form No. 02 in Appendix issued together with, details of matters to be changed and related documents.

Within 15 working days after receiving a duly completed application, the Ministry of Information and Communications shall verify and reissue a modified license; in case of refusal, it shall send a notice and provide explanation.

The validity period of the modified license is the remaining validity period of the former license.

2. If the license is lost or damaged, the license holder shall submit an application for reissuance to the Ministry of Information and Communications using Form No. 03 in Appendix issued herewith, specifying reasons for reissuance. Within 7 working days after receiving the application, the Ministry of Information and Communications shall consider reissuing the license.

The validity period of the reissued license due to loss or damage is the remaining validity period of the former license.

3. In order to ensure the continuity of service, the license holder wishes to keep providing service shall submit an application dossier for reissuance of license at least 90 days before the license expires. Application dossier for reissuance of license going to expire includes:

a) An application of reissuance of license to provide public authentication of digital signatures because of expired former license using form No. 03 in Appendix issued herewith.

b) A certificate of deposit made by a commercial bank operating in Vietnam as prescribed in Clause 2 Article 14 of this Decree;

c) Changes in personnel, technology related to the licensing conditions as prescribed in Clause 3,4 Article 13 of this Decree (if any).

Within 30 working days from the date of receipt of valid application dossier, the Ministry of Post and Telecommunications shall take charge and cooperate with the Ministry of Public Security, Government Cipher Committee and the concerned ministries, branches to verify dossier and reissue a license to the applicant if it meets licensing conditions. In case of refusal, the Ministry of Information and Communications shall give a notice and provide explanation.

The validity period of license reissued due to the former license’s expiry is 10 years.

Article 17. Suspension of licenses,  suspension of issuance of digital certificates

1. A public certification authority shall have its license suspended for a period of up to 6 months if it falls under one of the following cases:

a) Provision of false service with content stated in the license;

b) Failure to meet one of the licensing conditions in the process of service provision as prescribed in Article 13 of this Decree;

c) Failure to pay full maintenance fees in 6 months.

2. A public certification authority must suspend the issuance of new digital certificates in the following cases:

a) The license to provide public authentication of digital signatures is suspended as prescribed in Clause 1 of this Article;

b) Upon detecting the errors in the system providing its services that may affect the interests of subscribers and the recipients.

3. While the license is suspended, if the public certification authority can correct objectionable conditions, the Ministry of Information and Communications shall permit the public certification authority to keep providing service.

Article 18. Revocation of licenses

1. A public certification authority shall have its license revoked when it falls under one of the following cases:

a) Failure to provide for service within 12 months from the issuing date without any legitimate reason;

b) Being dissolved or declared bankrupt in accordance with provisions of relevant laws;

c) The license to provide the public authentication service of digital signatures has expired;

d) Failure to pay full maintenance fees in 12 months;

dd) Failure to correct objectionable conditions specified in clause 1 of Article 17 after the period of temporary suspension fixed by the state agencies;

e) The license holder does not want to keep providing service.

2. The public certification authority which had its license revoked is responsible for reaching an agreement to hand over the database relating to the provision of its service to another public certification authority that is operating within a period of not exceeding 30 days from the date of revocation of license.

3. The Ministry of Information and Communications shall supervise and guide the handover between the certification authorities to keep the services provided for subscribers uninterrupted.

If the certification authority fails to agree on such a handover with another certification authority, the Ministry of Information and Communications shall appoint one or certain public certification authorities to do that. The receiving certification authority shall keep performing rights and obligations towards subscribers and recipients under the agreement entered into between the subscribers and the former certification authority, which had its license revoked.

4. The costs of receiving and maintaining databases and assurance of continuous service provided for subscribers of shall be taken from deposit at the bank of the certification authority which has its license revoked.

5. After a period of 03 years from the date of revocation of license, except for the revocation prescribed in Point c Clause 1 of this Article, the above public certification authority may apply for reissuance of license.  Conditions and procedures for reissuance are conducted according to the regulations as for the cases of applying for new issuance.

Article 19. Validity period of digital certificates granted to public certification authorities

Validity period of digital certificates granted to public certification authorities is 5 years.

Article 20. Conditions for issuance of digital certificates to public certification authorities

1. Having the license to provide public authentication of digital signatures granted by the Ministry of Post and Telecommunications which is still valid.

2. The actual technical system meets conditions as specified in the licensing application dossier.

3. Public key on the digital certificate will be issued as a unique and the same pair with private key of public certification authority applying for digital certificate.

Article 21. Application dossier for issuance of digital certificates of public certification authorities

An application dossier for issuance of digital certificates made by a public certification authority includes:

1. An application for issuance of digital certificate using form No. 04 in Appendix issued herewith to Root Certification Authority.

2. A copy of license to provide public authentication of digital signatures.

3. Other documents as prescribed in the authentication regulation of Root Certification Authority.

Article 22. Verification and issuance of digital certificates to public certification authorities

Within 30 working days after receiving a valid application dossier, Root Certification Authority shall verify the application:

1. Root Certification Authority shall verify the following:

a) Check if the actual technical system of the public certification authority meets conditions as specified in the application;

b) Witness the generation of the private key and public key of the public certification authority to ensure that they are generated in a secured manner as prescribed.

2. If the conditions for issuance of digital certificate are satisfied, Root Certification Authority shall issue a digital certificate. If the conditions are not satisfied, Root Certification Authority shall issue a written refusal with explanation.

3. The issuance of digital certificate to a public certification authority by Root Certification Authority must ensure the continuity of service provided for subscribers.

Section 2: SERVICES PROVIDED BY PUBLIC CERTIFICATION AUTHORITIES

Article 23. Application dossier for issuance digital certificates made by subscribers

1. An application for issuance of digital certificate using the form given by the public certification authority.

2. The attached documents include:

a) For individuals:  ID card or citizen identification card or passport;

b) For organizations:  establishment decision or decision on functions, tasks, powers and organizational structure or certificate of business registration or investment certificate; ID card, citizen identification card, or passport of legal representative.

3. Individuals and organizations may choose to submit certified copies from master register, certified true copies or certified copies together with originals in their discretion.

Article 24. Creation of the key and key distribution for subscribers

1. An applicant for issuance of digital certificate may self-create a key pair or request the public certification authority in writing to create a key pair.

2. If the applicant self-creates a key pair, the public certification authority must make sure that such applicant has used devices according to prescribed standards to create and store the key pair.

3. Where public certification authority creates a key pair, it must use safe methods to transfer the private key to the applicant and may save a copy of the private key when the applicant requests in writing.

Article 25. Issuance of digital certificates to subscribers

1. The public certification authorities may issue a digital certificate to a subscriber only if:

a) Information declared in the application for issuance of digital certificate is correct;

b) Public key on the digital certificate will be issued as a unique and the same pair with private key of the applicant for digital certificate.

2. Digital certificates are only issued to the applicants and must contain all the information prescribed in Article 5 of this Decree.

3. The public certification authority may only publish the digital certificate issued to the subscriber on the database on their digital certificates after the subscriber confirmed that the information on the digital certificate is correct; the publishing time is no later than 24 hours after the confirmation of subscription, unless otherwise agreed.

4. Public certification authorities may not refused to issue digital certificates to applicants without legitimate reason.

5. Public certification authorities must maintain security during the creation and transfer of digital certificates to subscribers.

Article 26. Renewal of digital certificates to subscribers

1. At least 30 days prior to the expiration of the digital certificate, the subscriber may request for renewal of digital certificate.

2. Upon receiving a request for renewal, the public certification authority is obliged to complete the procedures for renewal of digital certificate before subscriber’s digital certificate expires.

3. In case of changing the public key on the digital certificates renewed, the subscriber must indicate clearly it in the written requests; the creation of key, key distribution and publication of renewed digital certificate shall comply with the provisions in Article 24, Article 25 of this Decree.

Article 27. Change of key pair for subscribers

In the case a subscriber wishes to change the key pair, it must submit an application for change. The key creation, key distribution, and publication of digital certificates with the new public key comply with the provisions in Article 24, Article 25 of this Decree.

Article 28. Suspension, revalidation of digital certificates of subscribers

1. A digital certificate of subscriber shall be suspended in any of the following cases:

a) When the subscriber requests in writing and the request was verified as accurate by the public certification authority;

b) When the public certification authority has grounds to assert that the digital certificate issued not in compliance with the provisions of Article 24, Article 25 of this Decree or detecting any errors that affect the interests of the subscriber and the recipients;

c) Upon request of the agencies proceeding procedures, police authorities or the Ministry of Post and Telecommunications;

d) As a condition to suspend digital certificate as stipulated in the contract between the subscriber and public certification authority.

2. When there are grounds to suspend the digital certificate, the public certification authority must conduct the temporary suspension, and immediately notify the subscriber and publish in the database of certificates on the suspension, the starting and ending time of the suspension.

3. The public certification authority shall revalidate the digital certificate when it has no longer grounds for suspension of the certificate or the period of suspension upon request has expired.

Article 29. Revocation of digital certificates of subscribers

1. A digital certificate of a subscriber is revoked in the following cases:

a) When the subscriber requests in writing and the request was verified as accurate by the public certification authority;

b) When subscriber as individual dies or is declared missing by the declaration of court or the subscriber as an organization is dissolved or declared bankrupt according to law regulations;

c) Upon request of the agencies proceeding procedures, police authorities or the Ministry of Post and Telecommunications;

d) As a condition to revoke digital certificate as stipulated in the contract between the subscriber and public certification authority.

2. When there are grounds to revoke the digital certificate, the public certification authority must revoke the digital certificate, and immediately notify the subscriber and publish in the database of certificates on the revocation.

Article 30. Issuance of timestamp

1. Timestamp issuance service is the attachment of information on the date and month, year and time in the data message.

2. Public certification authorities have the rights to provide the service of timestamp issuance.  The supply of service of timestamp issuance must comply with technical regulations and mandatory standards to apply to the service of timestamp issuance.

3. Date, month, year and time is attached to the data message is the date, month, year and time that public certification authorities receive such data messages and authenticated by the timestamp issuer.

4. Time source of timestamp issuers must comply with regulations of law on national standard time source.

Article 31. Authentication regulations of public certification authorities

1. Authentication regulations of public certification authority shall be made according to the authentication regulation of Root Certification Authority.

2. Authentication regulations of public certification authorities must be published as prescribed in Clause 2 Article 33 of this Decree.

3. If there is any change in the authentication regulation, the public certification authority shall send a notice to Root Certification Authority and request for written approval from Root Certification Authority.

Section 3: RIGHTS AND OBLIGATIONS OF PUBLIC CERTIFICATION AUTHORITY

Article 32. Obligations of public certification authorities to subscribers

1. Ensure the service provided for the subscriber is continuous, uninterrupted throughout the validity period of the digital certificate and the digital certificate’s status has been checked continuously.

2. Deal with risks and compensation for the subscriber and recipients by a cause for which the public certification authority is responsible.

3. Ensure private security, private information and storage devices of digital certificate in accordance with law on information security and relevant laws.

4. Receiving information:

Ensure information channel to receive requests from subscribers related to digital certificates to operate 24 hours per day and seven days per week.

5. Regarding key management:

a) Promptly notify subscribers and adopt measures to prevent and correct promptly in case of detecting exposure signals of the subscribers’ private keys, impaired integrity or any other error that adversely affects the interests of subscribers.

b) Recommend the subscribers on the change of key pairs as needed to ensure reliability and high security for the key pairs.

6. In a case where the issuance of new digital certificates must be suspended:

During the suspension of the issuance of new digital certificates, the public certification authorities are responsible for maintaining the database system related to digital certificates issued.

7. When a public certification authority had its license revoked, it must promptly notify subscribers of the suspension and the new certification authority to ensure interests of the subscribers.

8. Prepare model contracts with subscribers, covering:

a) Scope and limit of use, security level, expenses associated with issuance and use of digital certificates and other information which possibly prejudices interests of subscribers;

b) Requirements to ensure safety in storage and use of the private key;

c) Procedures for complaints and resolution of disputes.

9. Perform rights and obligations of the principal (in the principal-agent relationship)a as prescribed in commerce law.

Article 33. Obligations of public certification authorities to regulatory authorities of digital signatures and authentication of digital signatures

1. Information disclosure:

Public certification authorities must announce and maintain information 24 hours per day and seven days per week on their websites the following information:

a) Their authentication regulation and digital certificates;

b) List of valid, suspended, revoked digital certificates of the subscribers;

c) Other necessary information as per the law.

2. Information update:

Public certification authorities must update any changes to information prescribed in Clause 1 of this Article within 24 hours as they arise.

3. Information provision:

Public certification authorities must provide Root Certification Authority online in real time with information about number of valid, suspended or revoked digital certificates for state management of authentication of digital signatures.

4. Information storage:

Store all information about suspension or revocation of licenses and database about subscribers, digital certificates for at least 5 years, since the date of suspension or revocation.

5. Pay maintenance fees as prescribed.

6. Send reports on a periodical basis or at the request of the Ministry of Information and Communications and competent state agencies.

Section 4: PUBLIC CERTIFICATION AGENTS

Article 34. Operating conditions of public certification agents

1. Being a trader, either a business entity legally incorporated or an individual doing trade independently, regularly and having business registered.

2. Having a specific address of transaction office.

3. Having an agency agreement with a public certification authority.

Article 35. Rights and obligations of public certification agents

1. Perform rights and obligations of the agent as prescribed in commerce law.

2. Provide subscribers with guidance on application dossier, procedures for issuance of digital certificate.

3. Put up the procedure for issuance of digital certificates at the agent head office.

4. Ensure information channel to receive requests from subscribers to operate 24 hours per day and seven days per week.

5. Send reports at the request of specialized agencies for state management of authentication of digital signatures.