B: Electronic Certification Service Management Measures

The following is the content

Issuing department: Ministry of Industry and Information Technology

Issue number: Ministry of Industry and Information Technology Order No. 1

The "Measures for the Administration of Electronic Authentication Services" was reviewed and adopted at the 6th executive meeting of the Ministry of Industry and Information Technology of the People's Republic of China on February 4, 2009 , is hereby announced and will come into effect on March 31, 2009. The "Measures for the Administration of Electronic Certification Services" issued by the former Ministry of Information Industry of the People's Republic of China and the People's Republic of China on February 8, 2005 (Order No. 35 of the Ministry of Information Industry of the People's Republic of China and the People's Republic of China) was abolished at the same time.

Minister Li Yizhong

February 28, 2009

Measures for the Management of Electronic Certification Services

Chapter 1 General Provisions

Article 1 In order to regulate the conduct of electronic certification services and implement supervision and management of electronic certification service providers, this is formulated in accordance with the provisions of the "Electronic Signature Law of the People's Republic of China" and other laws and administrative regulations. this method.

Article 2: Electronic certification services as mentioned in these Measures refer to activities that provide authenticity and reliability verification for all parties involved in electronic signatures.

The electronic certification service provider referred to in these Measures refers to an organization that provides certification services for electronic signatures that require third-party certification (hereinafter referred to as the "electronic certification service organization").

Electronic certification service agencies that provide services to the public should be established in accordance with the law.

Article 3: These Measures shall apply to the establishment of electronic certification service agencies and the provision of electronic certification services for electronic signatures within the territory of the People’s Republic of China.

Article 4 The Ministry of Industry and Information Technology of the People's Republic of China and the People's Republic of China (hereinafter referred to as the "Ministry of Industry and Information Technology") shall supervise and manage electronic certification service agencies and electronic certification services in accordance with the law.

Chapter 2 Electronic Certification Service Agencies

Article 5 Electronic certification service agencies shall meet the following conditions:

(1) Have independent corporate legal person qualifications.

(2) Have personnel suitable for providing electronic certification services. There must be no less than thirty professional technical personnel, operation management personnel, safety management personnel and customer service personnel engaged in electronic certification services, and they should meet the skill requirements of the corresponding positions.

(3) The registered capital shall not be less than RMB 30 million.

(4) Having a fixed business location and a physical environment that meets the requirements for electronic certification services.

(5) Have technology and equipment that comply with relevant national safety standards.

(6) Have documents proving that the national password management agency agrees to use passwords.

(7) Other conditions stipulated by laws and administrative regulations.

Article 6 To apply for an electronic certification service license, the following materials shall be submitted to the Ministry of Industry and Information Technology:

(1) Written application.

(2) Personnel certification.

(3) Fund proof (financial accounting reports of the past three years audited in accordance with the law, capital verification report of newly established companies).

(4) Proof of business location.

(5) Certificate issued by the relevant national certification and testing agency that the technology, equipment, and physical environment comply with relevant national safety standards.

(6) Documents proving that the national cryptography management agency agrees to use passwords.

Article 7: The Ministry of Industry and Information Technology will conduct a formal review of the submitted application materials. If the application materials are complete and comply with the legal form, an acceptance notice shall be issued to the applicant. If the application materials are incomplete or do not comply with the legal form, the applicant shall be notified on the spot or within five days of all the content that needs to be supplemented and corrected.

Article 8: The Ministry of Industry and Information Technology shall conduct a substantive review of the application materials decided to accept. If the relevant content needs to be verified, two or more staff members will be assigned to conduct on-site verification.

Article 9: The Ministry of Industry and Information Technology shall seek written opinions from the People's Republic of China, the Ministry of Commerce and other relevant departments on matters related to the applicant.

Article 10: The Ministry of Industry and Information Technology shall make a written decision on whether to grant permission or not within 45 days from the date of receipt of the application. If permission is not granted, the applicant shall be notified in writing and the reasons shall be explained; if permission is granted, an "Electronic Certification Service License" shall be issued and the following information shall be announced: (1) "Electronic Certification Service License" number .

(2) Name of electronic certification service agency.

(3) Issuing authority and date of issuance.

If any information related to the electronic certification service license changes, the Ministry of Industry and Information Technology shall announce it in a timely manner.

The "Electronic Certification Service License" is valid for five years.

Article 11: Those who obtain an electronic certification service license shall go to the industrial and commercial administration authorities to handle relevant procedures with the "Electronic Certification Service License".

Article 12 An electronic certification service agency that has obtained certification qualifications shall publish the following information through the Internet before providing electronic certification services:

(1) Organization name and legal representative .

(2) Institutional address and contact information.

(3) "Electronic Certification Service License" number.

(4) Issuing authority and date of issuance.

(5) The starting and ending time of the validity period of the "Electronic Certification Service License".

Article 13 The electronic certification service agency plans to change the company name, domicile, legal representative, registered capital, type, shareholders, and shareholder’s investment method and capital contribution within the validity period of the "Electronic Certification Service License" If the amount, time of investment and other matters are changed, the Ministry of Industry and Information Technology must be submitted for approval before applying to the company registration authority for change registration.

Article 14 If the validity period of the "Electronic Certification Service License" expires and needs to be extended, the electronic certification service agency shall apply to the Ministry of Industry and Information Technology for renewal procedures thirty days before the expiration date of the license, and The relevant information shall be published in accordance with the provisions of Article 12 of these Measures within five days from the date of completion.

Chapter 3 Electronic Certification Services

Article 15 Electronic certification service agencies shall formulate their own regulations in accordance with the "Electronic Certification Business Rules and Specifications" promulgated by the Ministry of Industry and Information Technology. The electronic certification business rules and corresponding certificate strategies shall be announced before providing electronic certification services and filed with the Ministry of Industry and Information Technology.

If there are changes to electronic certification business rules and certificate policies, the electronic certification service agency shall announce them and file them with the Ministry of Industry and Information Technology within thirty days from the date of announcement.

Article 16 Electronic certification service agencies shall provide electronic certification services in accordance with the published electronic certification business rules.

Article 17 Electronic certification service agencies shall ensure the provision of the following services:

(1) Production, issuance and management of electronic signature certification certificates.

(2) Confirm the authenticity of the issued electronic signature authentication certificate.

(3) Provide electronic signature authentication certificate directory information query services.

(4) Provide electronic signature authentication certificate status information query services.

Article 18: Electronic certification service agencies shall perform the following obligations:

(1) Ensure that the contents of the electronic signature certification certificate are complete and accurate within the validity period.

(2) Ensure that the electronic signature relying party can verify or understand the content and other relevant matters contained in the electronic signature certification certificate.

(3) Properly preserve information related to electronic certification services.

Article 19: Electronic certification service agencies shall establish complete security management and internal audit systems.

Article 20 Electronic certification service agencies shall abide by the state’s confidentiality regulations and establish a complete confidentiality system.

Electronic certification service agencies have the obligation to keep confidential the information of electronic signatories and electronic signature relying parties.

Article 21 Before accepting an application for an electronic signature certification certificate, the electronic certification service agency shall inform the applicant of the following matters:

(1) Electronic signature certification certificate and electronic signature conditions of use.

(2) Items and standards of service charges.

(3) Permissions and responsibilities to save and use certificate holder information.

(4) Scope of responsibilities of electronic certification service agencies.

(5) Scope of responsibility of the certificate holder.

(6) Other matters that need to be notified in advance.

Article 22: After accepting an application for electronic signature certification, the electronic certification service agency shall sign a contract with the certificate applicant to clarify the rights and obligations of both parties.

Chapter 4 Suspension and Termination of Electronic Certification Services

Article 23 If an electronic certification service agency plans to terminate electronic certification services within the validity period of the "Electronic Certification Service License" , shall report to the Ministry of Industry and Information Technology sixty days before terminating services, go through the cancellation procedures for the "Electronic Certification Service License", and apply to the industrial and commercial administration authorities for cancellation of registration or change of registration with relevant certification documents from the Ministry of Industry and Information Technology. .

Article 24: If an electronic certification service agency plans to suspend or terminate electronic certification services, it shall notify relevant parties of business undertaking and other relevant matters ninety days before suspending or terminating electronic certification services.

If an electronic certification service agency intends to suspend or terminate electronic certification services, it shall report to the Ministry of Industry and Information Technology sixty days before suspending or terminating electronic certification services, and negotiate with other electronic certification service agencies on business undertakings. Negotiate and make appropriate arrangements.

Article 25 If an electronic certification service agency plans to suspend or terminate electronic certification services and fails to reach an agreement with other electronic certification service agencies on business undertaking matters, it shall apply to the Ministry of Industry and Information Technology to arrange for other electronic certification services. Certification service agencies undertake its business.

Article 26: If the electronic certification service license of an electronic certification service agency is revoked in accordance with the law, its business undertaking matters shall be handled in accordance with the regulations of the Ministry of Industry and Information Technology.

Article 27: Electronic certification service agencies have the obligation to undertake the electronic certification service business carried out by other agencies according to the arrangements of the Ministry of Industry and Information Technology.

Chapter 5 Electronic Signature Authentication Certificate

Article 28 The electronic signature authentication certificate shall accurately state the following contents:

(1) Issuance of electronic signature The name of the electronic certification service agency that authenticates the certificate.

(2) Name of certificate holder.

(3) Certificate serial number.

(4) Certificate validity period.

(5) Electronic signature verification data of the certificate holder.

(6) Electronic signature of the electronic certification service agency.

(7) Other contents specified by the Ministry of Industry and Information Technology.

Article 29 Under any of the following circumstances, the electronic certification service agency may revoke the electronic signature certification certificate issued by it:

(1) The certificate holder applies for revocation of the certificate .

(2) The information provided by the certificate holder is untrue.

(3) The certificate holder fails to perform its obligations under the contract between the two parties.

(4) The security of the certificate cannot be guaranteed.

(5) Other situations stipulated in laws and administrative regulations.

Article 30 If any of the following circumstances occurs, the electronic certification service agency shall inspect the relevant materials provided by the applicant to prove the identity and review the relevant materials:

(1) The applicant applies for an electronic signature certification certificate.

(2) The certificate holder applies for renewal of the certificate.

(3) The certificate holder applies to revoke the certificate.

Article 31: When an electronic certification service agency updates or revokes an electronic signature certification certificate, it shall make an announcement.

Chapter 6 Supervision and Management

Article 32 The Ministry of Industry and Information Technology shall conduct regular and irregular supervision and inspection of electronic certification service agencies. The content of supervision and inspection mainly includes legal Regulatory compliance, safe operations management, risk management, etc.

When the Ministry of Industry and Information Technology conducts supervision and inspection on electronic certification service agencies, it shall record the supervision and inspection situation and the results, which shall be signed by the supervisory and inspection personnel and filed. The public has the right to inspect supervision and inspection records.

The Ministry of Industry and Information Technology shall supervise and inspect electronic certification service agencies and shall not hinder the normal production and business activities of electronic certification service agencies and shall not charge any fees.

Article 33: An electronic certification service agency that has obtained an electronic certification service license shall not reduce the conditions it should have met when it was established during the validity period of the electronic certification service license.

Article 34: Electronic certification service agencies shall truthfully submit certification business development reports, financial accounting reports and other relevant information to the Ministry of Industry and Information Technology.

Article 35 If an electronic certification service agency has any of the following circumstances, it shall report to the Ministry of Industry and Information Technology in a timely manner:

(1) Major system or key equipment accidents.

(2) Major property losses.

(3) Major legal proceedings.

(4) Changes in personnel in key positions.

Article 36: Electronic certification service agencies shall provide on-the-job training for their employees.

Article 37: Based on the needs of supervision and management work, the Ministry of Industry and Information Technology may entrust the information industry departments of relevant provinces, autonomous regions and municipalities directly under the Central Government to undertake specific supervision and management matters.

Chapter 7 Penalties

Article 38 Electronic certification service agencies conceal relevant information from the Ministry of Industry and Information Technology, provide false materials, or refuse to provide true materials reflecting their activities. If the violation is found, the Ministry of Industry and Information Technology will order it to make corrections, give a warning or impose a fine of not less than 5,000 yuan but not more than 10,000 yuan.

Article 39 If staff members of the Ministry of Industry and Information Technology and the information industry departments of provinces, autonomous regions, and municipalities directly under the Central Government fail to perform their supervisory and management duties in accordance with the law, the Ministry of Industry and Information Technology or the provinces, autonomous regions, or municipalities directly under the Central Government shall The information industry authorities of the municipalities directly under the Central Government shall, in accordance with their powers, give administrative sanctions of warning, demerit, major demerit, demotion, dismissal, or expulsion depending on the severity of the case; if a crime is constituted, criminal liability shall be pursued in accordance with the law.

Article 40 If an electronic certification service agency violates the provisions of Articles 13, 15, and 27 of these Measures, the Ministry of Industry and Information Technology shall, in accordance with its authority, order it to make corrections within a time limit and impose a fine A warning and a fine of up to 10,000 yuan may be imposed.

Article 41 If an electronic certification service agency violates the provisions of Article 33 of these Measures, the Ministry of Industry and Information Technology shall, in accordance with its authority, order it to make corrections within a time limit, impose a fine of not more than 30,000 yuan, and impose a fine of not more than 30,000 yuan. The above situation is announced to the public.

Chapter 8 Supplementary Provisions

Article 42 After approval by the Ministry of Industry and Information Technology in accordance with relevant agreements or the principle of reciprocity, electronic authentication outside the People’s Republic of China The electronic signature certification certificate issued by the service agency overseas has the same legal effect as the electronic signature certification certificate issued by the electronic certification service agency established in accordance with these Measures.

Article 43 These Measures shall come into effect on March 31, 2009. The "Measures for the Administration of Electronic Authentication Services" (Order No. 35 of the Ministry of Information Industry of the People's Republic of China and the State Council) issued on February 8, 2005 is abolished at the same time.