North Carolina Administrative Code › Title 18 - SECRETARY OF STATE › Chapter 10 - ELECTRONIC COMMERCE SECTION › Section .0300 - PUBLIC KEY TECHNOLOGY › Section 10 .0302 - PUBLIC KEY TECHNOLOGY CERTIFICATION AUTHORITY: CERTIFICATE ISSUANCE AND MANAGEMENT - OVERVIEW

Current through Register Vol. 39, No. 2, July 15, 2024
(a) Overview. The
				Rules in this Section specify minimum requirements for issuance and management
				of certificates that may be used in verifying digital signatures. The digital
				signatures may be used on categories of electronic communications specified as
				suitable applications in
				18 NCAC
				10 .0302(b)(5).Each item in
				the Rules in this Section must be specifically addressed by the Certification
				Authority in the Certification Authority's Certification Practice Statement
				filed with the North Carolina Department of the Secretary of State at the time
				the Certification Authority submits an application for licensure or
				renewal.
(b) Community and
				Applicability.
(1) Certification Authorities.
				The Rules in this Chapter are binding on each licensed Certification Authority
				issuing certificates identifying them, and govern Certification Authority
				performance with respect to all certificates it issues referencing the Rules.
				Specific Certification Authority Practice Statements and procedures
				implementing the requirements of the Rules in this Chapter shall be set forth
				in the Certification Authority Certification Practice Statement;
(2) Certification Authorities Authorized to
				Issue Certificates Under the Rules in this Chapter. Any Certification Authority
				may issue certificates identifying the Rules in this Chapter if licensed in the
				State of North Carolina and the Certification Authority agrees to be bound by
				and comply with the undertakings and representations of the Rules in this
				Chapter with respect to such certificates. Issuance of a certificate
				referencing this Item shall constitute issuing the agreement of the
				Certification Authority to be bound by terms of the Rules for all certificates
				referencing them;
(3) Subscribers.
				A Certification Authority may issue certificates that reference the Rules in
				this Chapter to the following classes of subscribers:
(A) individuals (unaffiliated);
(B) individuals associated with a sponsor
				recognized by the Certification Authority ("affiliated individuals"), provided
				the sponsor is the subscriber of a valid certificate issued by the
				Certification Authority in accordance with the Rules in this Chapter;
(C) public agencies, as defined in
				G.S.
				66-58.2; and
(D) organizations and businesses qualified as
				legal entities;
(4)
				Relying Parties. The Rules in this Chapter benefit the following persons, who
				may rely on certificates issued to others referencing them ("Qualified Relying
				Parties"):
(A) individuals intending to
				engage in a transaction with a public agency;
(B) public agencies, as defined in
				G.S.
				66-58.2;
(C) organizations and businesses, qualified
				as legal entities, engaged in a transaction with a public agency; and
(D) other parties to a transaction with the
				entity and a public agency;
(5) Suitable Applications. Certificates
				referencing this Item are intended to provide a level of identity binding
				assurance and the protection of document encryption, and are typically suitable
				for:
(A) System Access / Systems Security
(i) Verifying the identity of electronic mail
				correspondents for non-critical communications;
(ii) Obtaining access to databases,
				applications and systems;
(iii)
				Message / document encryption for protection of contents/identities.
(B) Digital Signature Activity
(i) Commerce involving various goods or
				services with various values;
(ii)
				Obtaining personal data relating to the subscriber.
(C) Message / Document Encryption: Documents
				encrypted to protect contents (e.g. privacy of subscriber);
(6) Some sample applications of
				the Rules in this Chapter are:
(A) Computing
				applications providing access to the certificate holder's own personal
				information;
(B) Request and
				distribution of text information or other types of copyrighted content for
				which fees are charged or subscriptions are required;
(C) Verifying the identity of communicating
				parties;
(D) Verifying signatures
				on contracts, government benefits statements, and other
				documentation;
(E) Signing of
				electronic messages; e.g. official reports, employee leave and travel
				reporting, tax withholding; and
(F)
				Secure transport of individual, patient specific medical / other privileged
				information over public networks.