The Malaysian Communications and Multimedia Commission (MCMC) took over the role of the Controller of Certification Authorities after the amendment of Digital Signature Act 1997 on 1st November 2001. Under the Act and its subsidiary legislations, there are five matters required to be registered. They are:
Licensed Certification Authority
The function of a licensed certification authority is to issue to a subscriber upon application and upon satisfaction of the licensed certification authority's requirements as to the identity of the subscriber to be listed in the certificate and upon payment of the prescribed fees and charges.
Licensed certification authority, before issuing any certificate, must take all reasonable measures to check for proper identification of the subscriber to be listed in the certificate.
The licensing of certification authorities is obligatory under the Digital Signature Act 1997.
The MCMC issues two stages of licenses for certification authorities:
-
The establishment stage; and
-
The operation stage.
The MCMC issues the establishment stage license for a period of not exceeding one year. During the period, a person has to fulfill all licensing requirements and may apply for the operation stage.
A person is only allowed to carry on or operate as a licensed certification authorities until that person has been issued with the operation stage of the license.
Qualification Requirements
A person intending to carry on or operate as a certification authority must satisfy the following requirements:
-
It is a body corporate incorporated in Malaysia or a partnership within the meaning of the Partnership Act 1961;
-
It maintains a registered office in Malaysia;
-
It has a working capital reasonably sufficient, according to the requirement of the Commission, to enable it to carry on or operate as a certification authority;
-
It files with the Commission a suitable guarantee;
-
It uses a trustworthy system for the generation and management of key pairs and certificates;
-
It uses an approved digital signature scheme for the generation of key pairs and for the creation and verification of digital signatures;
-
It has an operating procedure that includes a certification practice statement, the measures to be taken to check the identity of subscribers to be listed in certificates, and the repositories and date/time stamp services to be used;
-
It employs as operative personnel only persons who;
-
Have not been convicted within the past 15 years of an offence involving fraud, false statement or deception; and
-
Have demonstrated knowledge and proficiency in following the requirement of the Act and its Regulations;
-
It complies with the licensing, standards and technical requirements under the Act and its Regulation; and
-
It complies with such other requirement as the Commission thinks fit.
-
A person fills in Form 1;
-
A person must provide the following information for the establishment stage:
-
The particular of the applicant
-
The anticipated operational costs and proposed financing;
-
Details of the personnel to be employed and their qualifications, if available;
-
The proposed operating procedure; and
-
The services to be provided and the fees and charges to be imposed thereof.
-
A person must provide the following information for the operation stage:
-
All valid information submitted for the establishment stage;
-
All new information and all the changes to the information submitted for the establishment stage, if any;
-
A suitable guarantee; and
-
A report from a qualified auditor certifying that the prescribed licensing, standards and technical requirements have been satisfied.
-
The prescribed fee; and
-
Such other information or document as the Commission may require.
Certificate Of Recognition For A Repository
The repository service is important and critical to the operation of an open Public Key Infrastructure. The development of robust and easily accessible repository service is a crucial mechanism to maintain the quality of certification authority services. Typically, a repository will contain the licensed certification authorities’ disclosure records, certificates, the most recent Certificate Revocation List (CRL), other suspension or revocation information and other information about certification practices.
Recognized Repositories
The MCMC issues a certificate of recognition for a repository in two stages:
-
The establishment stage; and
-
The operation stage.
The MCMC issues the establishment stage certificate for a period of not exceeding one year. During the period, a person has to fulfill all the certification requirements and may apply for the operation stage.
A person is only allowed to carry on or operate as a recognized repository until that person has been issued with the operation stage certificate.
Qualification Requirements
A person intending to carry on or operate as a repository must satisfy the following requirements:
-
It is a body corporate incorporated in Malaysia or a partnership within the meaning of the Partnership Act 1961 [Act 135];It maintains a registered office in Malaysia; It has a working capital reasonably sufficient, according to the requirement of the Commission, to enable it to conduct business as a Repository; It employs as operative personnel only persons who:
-
Have not been convicted within the past fifteen years of an offence involving fraud, false statement or deception; andHave demonstrated knowledge and proficiency in following the requirement of the Act and its Regulations;
-
The repository includes a date base that is capable of containing:
-
Certification Authority disclosure records for licensed Certification Authority;
-
Certificates to be published in the repository;
-
Notices of suspended or revoked certificates to be published by a licensed certification authority or any person suspending or revoking certificates;
-
Notice of termination of suspension of certificates to be published by a licensed certification authority or any person suspending certificates;
-
Advisory statements, written defenses thereto and decisions made by the Commission thereon to be published by the Commission under the Act and its Regulations; and
-
Such other information as the Commission thinks fit;
-
It operates by means of a trustworthy system;
-
The repository contains no significant amount of information that the Commission finds is known or likely to be untrue, in accurate or not reasonably reliable;
-
The repository contains certificates published by certification authorities that are required to conform to rules of practice that are similar to or more stringent that the requirement of the Act and its Regulations;
-
It keeps and maintains an archive of certificates that have been suspended or revoked, or that have been expired at least he preceding ten years;
-
It complies with the certification, standards and technical requirements under the Act and its Regulation; and
-
It complies with such other requirement as the Commission thinks fit.
A way of vouching the exact time when a computer record (messages, document, or even digital signatures) was created or last modified is by using a digital date/time stamping system. A digital date/time stamp is basically a cryptographically non-forgeable digital declarations which can be used as evidence of the date and time a computer record was created. The date/time stamp can be attached to a digital signature, message or other document if required by any written law.
Recognized Date/Time Stamp Services
The Commission issues a certificate of recognition for a date/time stamp service in two stages:
-
The establishment stage; and
-
The operation stage.
The Commission issues the establishment stage certificate for a period of not exceeding one year. During the period, a person has to fulfill all the certification requirements and may apply for the operation stage.
A person is only allowed to carry on or operate as a recognized date/time stamp service until that person has been issued with the operation stage certificate.
Qualification Requirements
A person intending to carry on or operate as a repository must satisfy the following requirements:
-
It is a body corporate incorporated in Malaysia or a partnership within the meaning of the Partnership Act 1961 [Act 135];
-
It maintains a registered office in Malaysia;
-
It has a working capital reasonably sufficient, according to the requirement of the Commission, to enable it to conduct business as a Repository;
-
It employs as operative personnel only persons who:
-
Have not been convicted within the past fifteen years of an offence involving fraud, false statement or deception; and
-
Have demonstrated knowledge and proficiency in following the requirement of the Act and its Regulations;
-
It operates by means of a trustworthy system;
-
It uses a reasonably secure and tamper-proof mechanism as it’s time-stamping device;
-
It keeps and maintains an archive of documents that have been time-stamped, irrespective that the contents of the document itself are not disclosed, within at least the preceding ten years;
-
It complies with the certification, standards and technical requirements under the Act and its Regulation; and
-
It complies with such other requirement as the Commission thinks fit.
-
A person fills in Form 1
-
For the establishment stage, a person must provide the following information:
-
The particular of the applicant
-
The anticipated operational costs and proposed financing;
-
Details of the personnel to be employed and their qualifications, if available;
-
The proposed operating procedure; and
-
The services to be provided and the fees and charges to be imposed thereof.
-
For the operation stage, a person must provide the following information
-
All valid information submitted for the establishment stage;
-
All new information and all the changes to the information submitted for the establishment stage, if any; and
-
A report from a qualified auditor certifying that the prescribed certification, standards and technical requirements have been satisfied.
-
The prescribed fee; and
-
Such other information or document as the Commission may require.
Recognition Of Foreign Certification Authority
The Commission may recognize by order of published in the Gazette, certification authorities licensed or otherwise authorized by governmental entities outside Malaysia. A certificate issued by recognized foreign certification authorities has the same effect as a certificate issued by a licensed certification authority of Malaysia.
Criteria For Recognition Of Foreign Certification Authorities
-
A foreign certification authority is eligible for recognition if an international treaty, agreement or convention concerning the recognition of its certificates has been concluded to which Malaysia is a party;
-
It must be licensed or otherwise authorized by the relevant governmental entity in that country to carry on or operate as a certification authority in that country;
-
The certificate issued by the foreign certification authority demonstrates a level of security equal to or more stringent than the level of security of a certificate issued by a licensed certification authority in Malaysia;
-
It has established a local agent for service of process in Malaysia;
-
It complies with the standards and technical requirements under the Act and its Regulations; and
-
It complies with such other requirements as the Commission thinks fit
-
Application for the Recognition of a Foreign Certification Authority.
Application For Recognition Of Foreign Certification Authorities
-
A foreign certification authority must apply in writing to the Commission for the recognition.
-
The application above must be accompanied by the following documents:
-
Proof that the criteria for recognition of foreign certification authorities have been satisfied, including a report from a qualified auditor certifying that the prescribed standards and technical requirements have been satisfied;
-
The prescribed fee; and
-
Such other information or document as the Commission may require.
|
Establishment Stage |
RM 2,500.00 |
|
Operation Stage |
RM 2,500.00 |
|
Granting Fee |
RM30,000.00 |
|
Annual Operating Fee |
RM 2,500.00 |
|
Renewal of license |
RM 2,500.00 |
|
Transfer of license |
RM 2,500.00 |
|
Establishment Stage |
RM 2,500.00 |
|
Annual Operating Fee |
RM 2,500.00 |
|
Operation Stage |
RM 2,500.00 |
|
Granting Fee |
RM30,000.00 |
|
Annual Operating Fee |
RM 2,500.00 |
|
Renewal of Certificate of Recognition |
RM30,000.00 |
|
Recognition of foreign certification authority |
RM 2,500.00 |
-
Digicert Sdn Bhd (457608-K)
No 3-20 & 3-22 Jalan Jalil Perkasa 14
Aked Esplanad, Bukit Jalil
57000 Kuala Lumpur
Licence No: LPBP-2/2010-(2)
Issuing date: 25 Dec 2010
Expiry date: 24 Dec 2015
Tel: +603 8992 8800
Fax: +603 8992 8810
www.digicert.com.my
-
MSC Trustgate.Com Sdn Bhd (478231-X)
Suite 2-9, Level 2 Block 4801
CBD Perdana
63000 Cyberjaya
Selangor
Licence No: LPBP-2/2010(1)
Issuing date: 25 July 2010
Expiry date: 24 July 2015
Tel: +603 8318 1800
Fax: +603 8319 1800
www.msctrustgate.com
-
Telekom Applied Business Sdn Bhd (455343-U)
16th Floor Tower 2 Faber Towers
Jalan Desa Bahagia, Taman Desa
58100 Kuala Lumpur
Licence No: LPBP-3/2013
Issuing date: 1 April 2013
Expiry date: 31 Mac 2018
Tel: +603 7984 4989
Fax: +603 7980 1605
www.tab.com.my
-
Digicert Sdn Bhd (457608-K)
No 3-20 & 3-22 Jalan Jalil Perkasa 14
Aked Esplanad, Bukit Jalil
57000 Kuala Lumpur
License No: PPR-2/2010-(2)
Issuing date: 25 Dec 2010
Expiry date: 24 Dec 2015
Tel: +603 8992 8800
Fax: +603 8992 8810
www.digicert.com.my
-
MSC Trustgate.Com Sdn Bhd (478231-X)
Suite 2-9, Level 2 Block 4801
CBD Perdana
Jalan Perdana
63000 Cyberjaya
Selangor
License No: PPR-2/2010(1)
Issuing date: 25 July 2010
Expiry date: 24 July 2015
Tel: +603 8318 1800
Fax: +603 8319 1800
www.msctrustgate.com
-
Telekom Applied Business Sdn Bhd (455343-U)
16th Floor Tower 2 Faber Towers
Jalan Desa Bahagia, Taman Desa
58100 Kuala Lumpur
Licence No: PPR-3/2013
Issuing date: 1 April 2013
Expiry date: 31 Mac 2018
Tel: +603 7984 4989
Fax: +603 7980 1605
www.tab.com.my
-
MSC Trustgate.Com Sdn Bhd (478231-X)
Suite 2-9, Level 2 Block 4801
CBD Perdana
Jalan Perdana
63000 Cyberjaya
Selangor
License No: PPR-2/2010(1)
Issuing date: 25 July 2010
Expiry date: 31 Dec 2012
Tel: +603 8318 1800
Fax: +603 8319 1800
www.msctrustgate.com
2. Telekom Applied Business Sdn Bhd (455343-U)
16th Floor Tower 2 Faber Towers
Jalan Desa Bahagia, Taman Desa
58100 Kuala Lumpur
Licence No: PPTM-2/2013
Issuing date: 1 April 2013
Expiry date: 31 Mac 2018
Tel: +603 7984 4989
Fax: +603 7980 1605
www.tab.com.my