Circular No. 09/2011/TT-BCT stipulates the management and use of digital signatures, certificates, and digital signature verification services of the Ministry of Industry and Trade.

CIRCULAR

Regulations on the management and use of digital signatures, digital certificates, and digital signature verification services of the Ministry of Industry and Trade

_______________________________

Pursuant to Decree No. 189/2007/NĐ-CP dated December 27, 2007 of the Government stipulating the functions, tasks, powers, and organizational structure of the Ministry of Industry and Trade;

Pursuant to Resolution No. 59/NQ-CP on simplifying administrative procedures within the scope of management functions of the Ministry of Industry and Trade;

Pursuant to Decree No. 26/2007/NĐ-CP dated February 15, 2007 of the Government detailing the implementation of the Electronic Transactions Law regarding digital signatures and digital signature certification services;

Pursuant to Decree No. 64/2007/NĐ-CP dated April 10, 2007 of the Government stipulating the application of information technology in the activities of state agencies;

The Minister of Industry and Trade hereby stipulates regulations on the management and use of digital signatures, digital certificates, and digital signature verification services of the Ministry of Industry and Trade as follows:

PART I

GENERAL PROVISIONS

Article 1. Scope of Regulation

This Circular stipulates the management and use of digital signatures, digital certificates, and digital signature verification services in electronic transactions of the Ministry of Industry and Trade.

Article 2. Applicability

1. Organizations and individuals under the Ministry of Industry and Trade, Provincial Departments of Industry and Trade, and centrally-administered city departments.

2. Other organizations and individuals choosing to use the digital signature service of the Ministry of Industry and Trade in electronic transactions organized by the Ministry of Industry and Trade.

Article 3. Explanation of Terms

In this Circular, the following terms are understood as follows:

1. "Digital certificate" is a type of electronic certificate issued by the organization providing digital signature services of the Ministry of Industry and Trade.

2. "Digital signature" is a form of electronic signature created by transforming a data message using an asymmetric cryptographic system such that anyone who has the original data message and the public key of the signer can accurately determine:

a) That the transformation was created using the correct private key corresponding to the public key in the same key pair;

b) The integrity of the content of the data message from the time of the transformation.

3. "Digital signature verification service" is a type of service managed by the organization providing digital signature services of the Ministry of Industry and Trade. Digital signature verification services include:

a) Creating a key pair including public and private keys for subscribers;

b) Issuing, renewing, suspending, restoring, and revoking subscriber digital certificates;

c) Maintaining an online database of certificates;

d) Other related services as prescribed in Decree No. 26/2007/NĐ-CP dated February 15, 2007 of the Government detailing the implementation of the Law on Electronic Transactions regarding digital signatures and digital signature verification services (referred to as the Digital Signature Decree).

4. "Signing digitally" is the process of inserting a private key into a software program to automatically create and attach a digital signature to a data message.

5. "Signer" is a subscriber who uses their own private key to sign digitally a data message.

6. "Recipient" is an organization or individual receiving a digitally signed data message, using the digital certificate of the signer to verify the digital signature in the received data message and proceed with relevant activities and transactions.

7. "Subscriber" is an organization or individual specified in Article 2 of this Circular; granted a digital certificate by the organization providing digital signature services of the Ministry of Industry and Trade; accepts the digital certificate and retains the private key corresponding to the public key recorded on the issued digital certificate.

8. "Subscriber management organization" is units under the Ministry of Industry and Trade, or other organizations requesting issuance of digital certificates for organizations and individuals under their organization and responsible according to the law on managing those organizations and individuals.

9. "Electronic transactions of the Ministry of Industry and Trade" are activities and operations conducted electronically by the Ministry of Industry and Trade.

Article 4. The organization providing digital signature services of the Ministry of Industry and Trade

The organization providing digital signature services of the Ministry of Industry and Trade, managed and operated by the Department of E-commerce and Information Technology, is the sole organization of the Ministry of Industry and Trade providing digital signature certification services.

Article 5. Digital certificate

1. Contents of the digital certificate:

The digital certificate managed by the organization providing digital signature services of the Ministry of Industry and Trade must include the following contents:

a) Name of the organization providing digital signature services;

b) Subscriber name;

c) Name of the subscriber management organization;

d) Certificate number;

đ) Validity period of the digital certificate;

e) Public key of the subscriber;

g) Digital signature of the organization providing digital signature services;

h) Restrictions on the purpose and scope of use of the digital certificate;

i) Legal liability restrictions of the organization providing digital signature services;

k) Other information for management, use, security, and confidentiality purposes as specified by the organization providing digital signature services.

2. Validity period of the digital certificate:

Not exceeding five (5) years for the digital certificate of the subscriber.

Chapter II

FUNCTIONS, TASKS OF THE ORGANIZATION PROVIDING DIGITAL SIGNATURE SERVICES, RIGHTS AND OBLIGATIONS OF USERS OF DIGITAL SIGNATURE SERVICES

RIGHTS AND OBLIGATIONS OF THE SUBJECTS USING DIGITAL SIGNATURE SERVICES

Article 6. Functions and tasks of the organization providing digital signature services

1. Managing the issuance, extension, suspension, revocation, restoration of digital certificates, and changing key pairs for subscribers upon request. Developing and ensuring the provision of secure and safe information services; providing digital signature services.

2. Managing and operating technical systems providing digital signature certification services of the Ministry of Industry and Trade, researching, upgrading, and ensuring continuous operation of the digital signature certification service of the Ministry of Industry and Trade safely. Testing and proposing new technologies to ensure information security and safety for electronic transactions.

3. Fully, accurately, and timely updating subscriber information for digital certificate management throughout the validity period of the digital certificate. In case the certificate is revoked, it must retain the digital certificate information of the subscriber for at least five years from the date of revocation.

4. The organization providing digital signature services has the function of certifying digital signatures circulating on electronic documents and in electronic transactions.

5. Guiding subscriber management organizations and subscribers to comply with the provisions of this Circular.

Article 7. Rights and obligations of subscriber management organizations

1. Receiving guidance information on procedures and processes for issuing, managing, and using digital certificates.

2. Requesting the organization providing digital signature services to issue, extend, suspend, restore, revoke digital certificates or change key pairs for subscribers under their management.

3. Being responsible for the accuracy of the information on applications for issuing, extending, suspending, restoring, revoking digital certificates and changing key pairs of subscribers under their management.

4. Guiding and inspecting subscribers under their management to use digital certificates and secret keys in accordance with the provisions of this Circular.

5. Promptly notifying the organization providing digital signature services in writing to suspend or revoke the digital certificate of a subscriber in cases stipulated in Article 15 of this Circular.

Article 8. Rights and Obligations of Subscribers

1. Receiving guidance information on procedures and processes for issuing, managing, and using digital certificates.

2. Through their own subscriber management organization to request issuance, extension, suspension, restoration, revocation of digital certificates or change of key pairs.

3. Subscribers may directly submit written requests to the service provider organization to suspend their digital certificates and must bear legal responsibility for such requests.

4. Use digital certificates for purposes registered.

5. Safeguard and use secret keys and data within the secret key storage device under "Confidential" regime.

6. Timely notify the service provider organization and their own subscriber management organization in case of discovering or suspecting that the digital certificate or secret key is no longer secure.

7. Comply with other legal regulations on the management and use of digital certificates.

Article 9. Obligations of Recipients

1. Before accepting a digital signature from the signer, the recipient must verify the following information:

a) The validity, scope of use, and liability limits of the digital certificate of the signer and the digital signature of the digital signature service provider organization;

b) The digital signature must be created using the secret key corresponding to the public key on the digital certificate of the signer.

2. The recipient shall bear all losses arising in the following cases:

a) Failure to comply with the provisions of Clause 1 of this Article;

b) Knowing or being informed about the untrustworthiness of the signer's digital certificate and secret key.

Chapter III

DIGITAL SIGNATURE VERIFICATION SERVICES

Article 10. Registration for Digital Signature Certification Service Usage

1. Organizations and individuals participating in using the Ministry of Industry and Trade’s digital signature certification service shall register for one of the following procedures:

a) Issuance of digital certificates (as stipulated in Article 12 of this Circular);

b) Extension of digital certificates (as stipulated in Article 13 of this Circular);

c) Change of key pairs (as stipulated in Article 14 of this Circular);

d) Suspension, revocation of digital certificates (as stipulated in Article 15 of this Circular);

đ) Restoration of digital certificates (as stipulated in Article 16 of this Circular).

2. Organizations and individuals can choose to register online at the website http://www.vsign.vn or register at the Ministry of Industry and Trade - Department of E-commerce and Information Technology, 25 Ngo Quyen Street, Hoan Kiem District, Hanoi.

Article 11. Procedure for Online Registration for Digital Signature Certification Service Usage

1. Subject must declare information into software provided by the Ministry of Industry and Trade and send electronic data to the Ministry of Industry and Trade. The online registration dossier includes:

a) An electronic application form requesting registration for digital signature certification service usage of organizations and individuals;

b) A scanned copy from the original establishment decision of the subscriber management organization for the first-time digital certificate issuance application (not applicable to units under the Ministry of Industry and Trade).

2. Staff receiving and processing the dossier of individuals registered in accordance with the law continues to be updated into the information declaration through the Internet and notify the result including computer-based multiple choice tests via the Internet to organizations and individuals. The verification result may fall into one of the following two cases:

a) Agree online if the information declared online is appropriate and valid;

b) Request organizations and individuals to modify and supplement information.

3. In the case of requiring modification and supplementation of information, organizations and individuals shall modify and supplement information according to the requirements of the issuing authority and transmit this declaration data online to the issuing authority for re-check until the information meets the requirements of the issuing authority.

4. After receiving the acceptance notification from the issuing authority regarding the completeness and validity of the online declaration information,For power plants invested under the Build-Operate-Transfer (BOT) model, n is determined according to the operational period of the power plant stipulated in the BOT contract.the entity responsible for providing the digital signature certification service will proceed to provide the service according to the request. The result will be returned by mail or directly at the Ministry of Industry and Trade's office.The entity responsible for providing digital signature authentication services shall provide such services upon request. The results will be returned via postal service or directly at the headquarters of the Ministry of Industry and Trade.

Article 12. Issuance of Digital Certificates

1. Conditions for Requesting Issuance of Digital Certificates:

Organizations and individuals requesting issuance of digital certificates must satisfy the following conditions:

a) General Conditions:

- Belong to the objects as prescribed in Article 2 of this Circular;

- Agree to comply with regulations for subscribers as stipulated in this Circular.

b) Additional Conditions for Objects Prescribed in Clause 2 of Article 2:

- Be a business established under Vietnamese law;

- Possess the capability to equip technical devices, organize and maintain operations consistent with the electronic transaction system of the Ministry of Industry and Trade;

- The legal representative understands laws regarding digital signatures and digital signature certification services.

2. Documents for Requesting Issuance of Digital Certificates:

Organizations and individuals requesting issuance of digital certificates may declare online via the Internet or submit at the headquarters of the Ministry of Industry and Trade (directly or through postal service). In cases where organizations and individuals choose to submit documents online, they shall follow the provisions set out in Article 11 of this Circular.

In cases where organizations and individuals choose to submit documents directly at the headquarters of the Ministry of Industry and Trade, the application package includes:

a) Actual costsa) A request for issuance of digital certificate (Annex No. 1) from the organization or individual, confirmed by the subscriber management organization.;

b) A certified copy of the decision on establishment of the subscriber management organization for the first-time application for a digital certificate (not applicable to units under the Ministry of Industry and Trade).

3. Within no more than 05 (five) working days from the date of receipt of a valid application for issuance of digital certificates, the service provider of digital signatures is responsible for checking and issuing digital certificates to subscribers if they meet the conditions, or providing a refusal letter specifying the reasons for refusal if the conditions are not met.

Article 13. Extension of Digital Certificates

1. Procedures for Extending Digital Certificates:

a) The digital certificate requested for extension must ensure at least 30 days remaining validity period;

b) Organizations and individuals extending digital certificates may declare online via the Internet or submit at the headquarters of the Ministry of Industry and Trade (directly or through postal service) a request for extension of the digital certificate of the subscriber, confirmed by the subscriber management organization (Annex No. 2);

c) Each digital certificate can be extended no more than 03 (three) times, with each extension period not exceeding 01 (one) year.

2. Processing Time for Extension Application Packages:

Within no more than 05 (five) working days from the date of receipt of a valid application for extension of digital certificates, the service provider of digital signatures is responsible for checking and extending the digital certificate for the subscriber if they meet the conditions, or providing a refusal letter specifying the reasons for refusal if the conditions are not met for extension of the digital certificate.

Article 14. Changing Key Pairs

1. Conditions for Changing Key Pairs:

a) There must be a request for changing key pairs from the subscriber and it must ensure that the remaining validity period of the digital certificate is at least 30 (thirty) days;

b) Organizations and individuals wishing to change key pairs may declare online via the Internet or submit at the headquarters of the Ministry of Industry and Trade (directly or through postal service) a request for changing key pairs (Annex No. 6) of the subscriber, confirmed by the subscriber management organization.

2. Changing Key Pairs is Conducted as Follows:

a) Ensuring the information reception channel for changing key pair requests operates 24 (twenty-four) hours a day and seven (seven) days a week;

b) Within no more than 05 (five) working days from the date of receipt of a valid application for changing keys, the service provider of digital signatures checks and changes the key pair for the subscriber;

c) Storing information related to the activity of changing key pairs for at least 05 years, starting from the date of change.

Article 15. Suspension and Revocation of Digital Certificates

1. The digital certificate of a subscriber may be suspended in the following cases:

a) An organization or individual wishing to suspend their digital certificate may declare online via the Internet or submit at the Ministry of Industry and Trade's office (in person or through postal service) a request from the subscriber, confirmed by the management organization (Annex 3) in cases where the secret key has been exposed or suspected to have been exposed; the device storing the secret key has been lost, copied, or other security breaches occur;

b) Upon a written request from competent state agencies;

c) Upon a written request from the management organization;

d) A service provider has sufficient grounds to determine that a subscriber has violated the provisions of this Circular;

e) A service provider discovers any errors or incidents that could affect the interests of subscribers or the security of the digital signature certification service system;

2. The electronic signature certificate of the subscriber shall be revoked in the following cases:

a) The digital certificate has expired;

b) Upon a written request from competent state agencies;

c) An organization or individual wishing to revoke their digital certificate may declare online via the Internet or submit at the Ministry of Industry and Trade's office (in person or through postal service) a request from the subscriber, confirmed by the management organization (Annex 5);

d) Upon a written request from the management organization;

e) The management organization or subscriber has been dissolved or declared bankrupt according to the law;

f) There is sufficient evidence to determine that a subscriber has violated the regulations on managing and using secret keys and devices storing secret keys as stipulated in this Circular;

g) The maximum suspension period for a digital certificate is 06 (six) months.

3. Service providers must ensure the following requirements:

a) Ensure that the information channel for receiving requests to suspend or revoke digital certificates operates 24 (twenty-four) hours a day, seven days a week;

b) Store information related to the suspension or revocation of digital certificates for at least 05 (five) years from the date the digital certificate was suspended or revoked;

c) When receiving a request to suspend or revoke a digital certificate from an organization or individual, or when there are sufficient grounds to suspend or revoke a digital certificate, the service provider must suspend or revoke the digital certificate within a period not exceeding 05 (five) working days.

Article 16. Restoration of Digital Certificates

1. Digital certificates may be restored in the following cases:

a) Upon a written request from competent state agencies;

b) An organization or individual wishing to restore their digital certificate may declare online via the Internet or submit at the Ministry of Industry and Trade's office (in person or through postal service) a request from the subscriber, accompanied by confirmation from the management organization (Annex 4), in cases where the subscriber or the management organization had previously requested the suspension of the digital certificate;

c) The suspension period of the digital certificate according to the suspension request has expired;

d) The digital certificate was suspended according to point đ, Clause 1, Article 15 of this Circular, and the errors or incidents have been resolved.

2. Within a period not exceeding 05 (five) working days from the date of receipt of a valid application for restoration of a digital certificate, the service provider is responsible for checking and restoring the digital certificate for the subscriber.

Chapter IV

IMPLEMENTING PROVISIONS

Article 17. Handling Violations, Complaints, and Resolving Disputes

The handling of violations, complaints, and resolving disputes related to the implementation of this Circular shall be carried out in accordance with the provisions of the Decree on electronic signatures and other relevant laws.

Article 18. Responsibility for Implementation

1. The E-commerce and Information Technology Department shall be responsible for:

a) Directing, monitoring, and inspecting the compliance with this Circular by units under the Ministry of Industry and Trade and other organizations using the Ministry of Industry and Trade's electronic signature services;

b) Ensuring the stable, secure, and continuous operation of the electronic signature system, researching and implementing advanced electronic signature technologies suitable for the activities of the Ministry of Industry and Trade.

2. The Inspectorate of the Ministry of Industry and Trade shall be responsible for coordinating with the E-commerce and Information Technology Department to inspect the implementation of this Circular.

3. Heads of units under the Ministry of Industry and Trade and heads of other organizations using the Ministry of Industry and Trade's electronic signature services shall be responsible for organizing the implementation and inspection at their own units in accordance with the provisions of this Circular.

Article 19. This Circular takes effect from May 15, 2011, and replaces Decision No. 40/2008/QĐ-BCT dated October 31, 2008, on the issuance of the Circular on managing and using electronic signatures, digital certificates, and electronic signature certification services of the Ministry of Industry and Trade.

Article 20. The Director of the Ministry's Office, the Head of the E-commerce and Information Technology Department, the Heads of units directly under the Ministry of Industry and Trade, and related organizations and individuals are responsible for enforcing this Circular./.