Circular No. 37/2009/TT-BTTTT dated December 14, 2009 of the Ministry of Information and Communications prescribing dossiers and procedures for licensing, registration and accreditation of institutional providers of digital signature certification services

THE MINISTRY OF INFORMATION AND COMMUNICATIONS 

Circular No. 37/2009/TT-BTTTT of December 14, 2009, prescribing dossiers and procedures for licensing, registration and accreditation of institutional providers of digital signature certification services

THE MINISTER OF INFORMATION AND COMMUNICATIONS

Pursuant to the November 29, 2005 Law on E-Transactions;

Pursuant to the Government’s Decree No. 26/2007/ND-CP of February 15, 2007, detailing the Law on E-Transactions regarding digital signatures and digital signature certification services;

Pursuant to the Government’s Decree No. 187/2007/ND-CP of December 25, 2007, defining the functions, tasks, powers and organizational structure of the Ministry of Information and Communications;

At the proposal of the director of the Department for Information Technology Application,

STIPULATES:

Chapter I

GENERAL PROVISIONS

Article 1. Scope of regulation

This Circular prescribes dossiers and procedures for licensing, registration and accreditation of institutional providers of digital signature certification services, including:

1. Licensing of provision of public digital signature certification services;

2. Suspension or revocation of licenses for provision of public digital signature certification services;

3. Issuance of digital certificates to institutional providers of public digital signature certification services;

4. Registration of operation of institutional providers of specialized digital signature certification services;

5. Issuance of certificates of qualification to assure safety for digital signatures;

6. Recognition of foreign digital signatures and certificates.

Article 2. Subjects of application

This Circular applies to organizations providing public digital signature certification services; authorities and organizations providing specialized digital signature certification services; and foreign organizations providing digital signature certification services which apply for digital signature recognition papers and digital certificates in Vietnam.

Chapter II

SPECIFIC PROVISIONS

Section 1. DOSSIERS

Article 3. Dossiers of application for licenses for provision of public digital signature certification services

1. A dossier of application for a license for provision of public digital signature certification services as specified in Article 16 of Decree No. 26/2007/ND-CP comprises:

a/ An application for a license, made according to a set form provided in Appendix I to this Circular;

b/ Certification rules compliant with Decision No. 59/2008/QD-BTTTT of December 31, 2008, promulgating the list of standards compulsorily applicable to digital signatures and digital signature certification services;

c/ Detailed information on personal identity, qualifications, degrees and diplomas of the head, the person responsible for management of the system of service-providing equipment, the person in charge of issuance of digital certificates and other relevant staff members.

2. A dossier of application for modification of a license as specified in Clause 2, Article 18 of Decree No. 26/2007/ND-CP comprises:

a/ An application for modification of a license, made according to a set form provided in Appendix II to this Circular;

b/ A report on operation, covering the general situation, number of issued digital certificates classified, number of revoked digital certificates and total number of valid digital certificates classified according to their types.

3. In case of application for re-issuance of licenses under Clause 5, Article 18 of Decree No. 26/2007/ND-CP, applications for re-issuance of licenses shall be made according to a set form provided in Appendix III to this Circular.

4. A dossier of application for extension of a license as specified in Clause 2, Article 19 of Decree No. 26/2007/ND-CP comprises:

a/ An application for extension of a license for provision of public digital signature certification services, made according to a set form provided in Appendix IV to this Circular;

b/ A copy of the license for provision of public digital signature certification services which remains valid for at least 60 days from the date of submission of the dossier;

c/ A report on service provision in the last 3 years under Point b, Clause 2 of this Article.

Article 4. Dossiers of application for digital certificates for institutional providers of public digital signature certification services

Such a dossier comprises:

1. A copy of the license for provision of public digital signature certification services issued by the Ministry of Information and Communications.

2. The papers specified in Article 21 of Decree No. 26/2007/ND-CP, including:

a/ An application for a digital certificate, made according to a set form provided in Appendix V to this Circular.

b/ The papers specified in certification rules of the Root Certification Authority of digital signature certification services posted on its website at http://www.rootca.gov.vn.

3. A request for issuance of a digital certificate in electronic form, made according to the digital signature standards promulgated by the Ministry of Information and Communications. Such a request must be made by the institutional provider of public digital signature certification services and compatible with its key pair.

Article 5. Dossiers for registration of operation of institutional providers of specialized digital signature certification services

Such a dossier comprises:

1. An application for registration of operation of the institutional provider of specialized digital signature certification services, made according to a set form provided in Appendix VI to this Circular.

Contents of registration of operation of institutional providers of specialized digital signature certification services comply with Article 46 of Decree No. 26/2007/ND-CP.

2. Documents evidencing that entities provided with services have the same operational characteristics or working purposes and associated with one another by their operation rules or a legal document which defines their common organizational structure or forms of association and operation satisfying the requirements specified in Clause 2, Article 4 of Decree No. 26/2007/ND-CP.

Article 6. Dossiers of application for certificates of qualification to assure safety for digital signatures of institutional providers of specialized digital signature certification services

A dossier application for a certificate of qualification to assure safety for digital signatures complies with Article 49 of Decree No. 26/2007/ND-CP and comprises:

1. An application for a certificate, made according to the form provided in Appendix VII to this Circular.

2. The Ministry of Information and Communications’ written approval of the registration of operation of the institutional provider.

3. Detailed information on personal identity, qualifications, degrees and diplomas of the head, the person responsible for management of the service-providing equipment system, the person in charge of issuance of digital certificates and other relevant staff members.

Article 7. Dossiers of application for papers of recognition of foreign digital signatures and certificates

A dossier of application for a paper of recognition of foreign digital signatures and certificates complies with Article 53 of Decree No. 26/2007/ND-CP and comprises:

1. An application for recognition of foreign digital signatures and certificates, made according to a set form provided in Appendix VIII to this Circular.

2. The original full text and a Vietnamese translation of the bilateral treaty providing the recognition of foreign signatures and certificates to which Vietnam has signed or acceded with the country where the institutional provider of digital signature certification services has registered its operation.

3. A valid copy (notarized or otherwise legally certified) of the license or the certificate of qualification for provision of digital signature certification services in the host country.

4. A certificate of operation of the institutional provider of digital signature certificate services issued by a competent authority of the host country within 3 months before the date of submission of the registration dossier.

5. Technical documents proving that the reliability of digital signatures and certificates issued by the foreign institutional provider of digital signature certificate services is not lower than that of digital signatures and certificates issued by a Vietnamese institutional provider of public digital signature certification services and at least satisfies the standards on the list of standards compulsorily applicable to digital signatures and digital signature certification services promulgated by the Ministry of Information and Communications.

6. A valid copy of the license for a Vietnam-based representative office.

Section 2. ORDER AND PROCEDURES

Article 8. Procedures for licensing provision of public digital signature certification services

1. Submission and receipt of dossiers

Organizations applying for licenses for provision of public digital signature certification services (issuance of new licenses, modification, re-issuance or extension of issued licenses) shall send their dossiers by post to or directly file them with the Ministry of Information and Communications (the Department for Information Technology Application), at 18 Nguyen Du street, Hai Ba Trung district, Hanoi.

Within 5 working days after receiving a dossier, the Ministry of Information and Communications shall examine the validity of the dossier. In case of an invalid dossier, the Ministry of Information and Communications shall notify such in writing to the applicant for modification or supplementation of the dossier.

2. Verification of dossiers

The Ministry of Information and Communications shall verify dossiers and consult concerned agencies and units under regulations. Consulted agencies and units shall give their written verifications and take responsibility for these dossiers’ matters under their management.

3. Decision on licensing

Within 60 working days after receiving a valid dossier, the Ministry of Information and Communications shall issue a license; modify, re-issue or extend an issued license. Licenses for provision of digital signature certification services are made according to a set form provided in Appendix IX to this Circular.

In case of refusal to issue a license, the Ministry of Information and Communications shall notify such in writing to the applicant, clearly stating the reason.

Article 9. Procedures for suspension or revocation of licenses for provision of public digital signature certification services

1. Institutional providers of public digital signature certification services shall have their licenses suspended in any of the cases specified in Clause 1, Article 20 of Decree No. 26/2007/ND-CP; or revoked in any of the cases specified Clause 2, Article 20 of Decree No. 26/2007/ND-CP.

2. Within 15 working days after the date of issuance of a decision on suspension of a license, if the organization with a suspended license fails to satisfy the condition for the lack of which the license is suspended, the Ministry of Information and Communications shall revoke the license under Point d, Clause 2, Article 20 of Decree No. 26/2007/ND-CP.

For other cases of license revocation specified at Points a, b and c, Clause 2, Article 20 of Decree No. 26/2007/ND-CP, the Ministry of Information and Communications shall issue decisions on license revocation after notifying it in writing to these organizations.

3. The Ministry of Information and Communications shall restore licenses if organizations with suspended licenses can satisfy the condition for the lack of which their licenses have been suspended within the prescribed time limit.

4. The Root Certification Authority shall publicize the suspension, restoration or revocation of licenses on its website at http://www.rootca.gov.vn., and notify them in writing to concerned organizations and individuals.

Article 10. Procedures for issuance of digital certificates to institutional providers of public digital signature certification services

1. Submission and receipt of dossiers

An institutional provider of public digital signature certification services applying for a digital certificate shall send 5 dossier sets (1 original and 4 copies) by post to or file them directly with the head office of the Root Certification Authority at 6 Chua Mot Cot street, Ba Dinh district, Hanoi.

Within 5 working days after receiving a dossier, the Root Certification Authority shall examine the validity of the dossier. In case of an invalid dossier, the Root Certification Authority shall notify such in writing to the applicant for modification or supplementation of the dossier.

2. Verification of dossiers

a/ Within 30 days after receiving a valid dossier, the Root Certification Authority shall verify the dossier and consider the application;

b/ In case the public key of the digital certificate applicant is identical to the public key of any institutional provider of public digital signature certification services which has been issued a digital certificate, the Root Certification Authority shall request the applicant to create a new key pair;

c/ Physical verification of the conditions for issuance of a digital certificate at the institutional provider of public digital signature certification services.

3. Issuance of digital certificates

a/ The Root Certification Authority shall issue digital certificates to applicants if their dossiers are valid and they satisfy all the prescribed conditions;

b/ The Root Certification Authority shall hand over digital certificates and notices of issuance of digital certificates to applicants and update information on its website at http://www.rootca.gov.vn;

c/ The Root Certification Authority shall maintain an online database on issued digital certificates on its website.

Article 11. Procedures for registration of operation of institutional providers of specialized digital signature certification services

1. Submission and receipt of dossiers

Institutional providers of specialized digital signature certification services shall send registration dossiers by post to or file them directly with the Ministry of Information and Communications (the Department for Information Technology Application), at 18 Nguyen Du street, Hai Ba Trung district, Hanoi.

2. Acceptance of registration

a/ The Ministry of Information and Communications shall examine dossiers of registration for provision of specialized digital signature certification services;

b/ Within 60 working days after receiving a valid dossier, the Ministry of Information and Communications shall notify registry offices in writing of its acceptance of the operation registration of the institutional provider of specialized digital signature certification services. Notices of acceptance are made according to the form provided in Appendix X to this Circular.

In case of non-acceptance, the Ministry of Information and Communications shall notify such in writing to registry offices, clearly stating the reason.

Article 12. Procedures for issuance of certificates of qualification to assure safety for digital signatures to institutional providers of specialized digital signature certification services

1. Submission and receipt of dossiers

Institutional providers of specialized digital signature certification services applying for a certificate of qualification to assure safety for digital signatures shall send their dossiers by post to or file them directly with the Ministry of Information and Communications (the Department for Information Technology Application) at 18 Nguyen Du street, Hai Ba Trung district, Hanoi.

Within 5 working days after receiving a dossier, the Ministry of Information and Communications shall examine the validity of the dossier. In case of an invalid dossier, the Ministry of Information and Communications shall notify such in writing to the applicant for modification or supplementation of the dossier.

2. Verification of dossiers

The Ministry of Information and Communications shall verify dossiers and consult concerned agencies and units under regulations. Consulted agencies and units shall give their written verifications and take responsibility for these dossiers’ matters under their management.

3. Issuance of certificates

Within 60 working days after receiving a valid dossier, the Ministry of Information and Technology shall issue a certificate of qualification to assure safety for digital signatures, made according to the form provided in Appendix XI to this Circular.

In case of refusal to issue a certificate, the Ministry of Information and Communications shall notify such in writing to the applicant, clearly stating the reason.

Article 13. Procedures for recognition of foreign digital signatures and certificates

1. Submission and receipt of dossiers

Institutional providers of foreign digital signature certification services applying for a paper of recognition of foreign digital signatures and certificates shall send their dossiers by post to or file them directly with the Ministry of Information and Communications (the Department for Information Technology Application) at 18 Nguyen Du street, Hai Ba Trung district, Hanoi.

Within 5 working days after receiving a dossier, the Ministry of Information and Communications shall examine the validity of the dossier. In case of an invalid dossier, the Ministry of Information and Communications shall notify such in writing to the applicant for modification or supplementation of the dossier.

2. Verification of dossiers

The Ministry of Information and Communications shall verify dossiers and consult concerned agencies and units. Consulted agencies and units shall give their written verifications and take responsibility for these dossiers’ matters under their management.

3. Issuance of papers of recognition

Within 60 working days after receiving a valid dossier, the Ministry of Information and Communications shall issue a paper of recognition of foreign digital signatures and certificates, made according to the form provided in Appendix XII to this Circular.

In case of refusal to issue a paper of recognition, the Ministry of Information and Communications shall notify such in writing to the applicant, clearly stating the reason.

Article 14. Fees and charges

Agencies and organizations shall pay fees and charges according to regulations when carrying out procedures for licensing, registration or recognition of institutional providers of digital signature certification services. The Root Certification Authority shall organize the payment and collection of these fees and charges under regulations.

Chapter III

ORGANIZATION OF IMPLEMENTATION

Article 15. Responsibilities of the Department for Information Technology Application

1. To guide and inspect agencies and organizations in carrying out procedures for licensing, registration and recognition of digital signature certification services under this Circular.

2. To take necessary measures to facilitate the management of the provision of digital signature certification services.

3. To publish forms and documents relevant to procedures for licensing, registration and recognition of institutional providers of digital signature certification services on the website http://www.rootca.gov.vn. The Root Certification Authority shall guide the forms and update information related to the licensing, registration and recognition of institutional providers of digital signature certification services on this website.

Article 16. Effect

1. This Circular takes effect on February 1, 2010.

2. Any problem arising in the course of implementation should be promptly reported to the Ministry of Information and Communications for consideration, amendment or supplementation.

For the Minister of Information and Communications
Deputy Minister
NGUYEN MINH HONG

* All appendices to this Circular are not printed herein.