Licences under the
Digital Signature Act 1997
Certificate of Recognition
for a Repository
Introduction
The repository service is important
and critical to the operation of an open Public Key Infrastructure. The development
of robust and easily accessible repository service is a crucial mechanism to maintain
the quality of certification authority services. Typically, a repository will contain
the licensed certification authorities’ disclosure records, certificates, the most
recent Certificate Revocation List (CRL), other suspension or revocation information
and other information about certification practices.
Recognised Repositories
The MCMC issues a certificate of
recognition for a repository in two stages:
| a) | The establishment stage; and | |
| b) | The operation stage. |
The MCMC issues the establishment stage certificate for a period of not exceeding one year. During the period, a person has to fulfil all the certification requirements and may apply for the operation stage.
A person is only allowed to carry on or operate as a recognised repository until that person has been issued with the operation stage certificate.
Qualification Requirements
A person intending to carry on or operate as a repository must satisfy the following requirements:
| a) | It is a body corporate incorporated in Malaysia or a partnership within the meaning of the Partnership Act 1961 [Act 135]; | |
| b) | It maintains a registered office in Malaysia; | |
| c) | It has a working capital reasonably sufficient, according to the requirement of the Commission, to enable it to conduct business as a Repository; | |
| d) |
It employs as operative personnel only persons who:
|
|
| e) |
The repository includes a date base that is capable of containing:
|
|
| f) | It operates by means of a trustworthy system; | |
| g) | The repository contains no significant amount of information that the Commission finds is known or likely to be untrue, in accurate or not reasonably reliable; | |
| h) | The repository contains certificates published by certification authorities that are required to conform to rules of practice that are similar to or more stringent that the requirement of the Act and its Regulations; | |
| i) | It keeps and maintains an archive of certificates that have been suspended or revoked, or that have been expired at least he preceding ten years; | |
| j) | It complies with the certification, standards and technical requirements under the Act and its Regulation; and | |
| k) | It complies with such other requirement as the Commission thinks fit. |
Application for Certification of Recognition for Repositories
| a) | A person fills in Form 1; | |
| b) |
For the establishment stage, a person must provide the following information:
|
|
| c) |
For the operation stage, a person must provide the following information:
|
|
| d) | The prescribed fee; and | |
| e) | Such other information or document as the Commission may require. |
