2005 Minnesota Statutes

     325K.15 Certificate revocation. 

    Subdivision 1.    After request.  A licensed 
 certification authority must revoke a certificate that it issued 
 but which is not a transactional certificate, after: 

    (1) receiving a request for revocation by the subscriber 
 named in the certificate; and 

    (2) confirming that the person requesting revocation is the 
 subscriber, or is an agent of the subscriber with authority to 
 request the revocation. 

    Subd. 2.    After identity confirmed.  A licensed 
 certification authority must confirm a request for revocation 
 and revoke a certificate within one business day after receiving 
 both a subscriber's written request and evidence reasonably 
 sufficient to confirm the identity and any agency of the person 
 requesting the suspension. 

    Subd. 3.    After death or dissolution.  A licensed 
 certification authority must revoke a certificate that it issued:

    (1) upon receiving a certified copy of the subscriber's 
 death record, or upon confirming by other evidence that the 
 subscriber is dead; or 

    (2) upon presentation of documents effecting a dissolution 
 of the subscriber, or upon confirming by other evidence that the 
 subscriber has been dissolved or has ceased to exist, except 
 that if the subscriber is dissolved and is reinstated or 
 restored before revocation is completed, the certification 
 authority is not required to revoke the certificate. 

    Subd. 4.    Unreliable certificate.  A licensed 
 certification authority may revoke one or more certificates that 
 it issued if the certificates are or become unreliable, 
 regardless of whether the subscriber consents to the revocation 
 and notwithstanding a provision to the contrary in a contract 
 between the subscriber and certification authority. 

    Subd. 5.    Notice of revocation.  Immediately upon 
 revocation of a certificate by a licensed certification 
 authority, the licensed certification authority must give notice 
 of the revocation according to the specification in the 
 certificate.  If one or more repositories are specified, then 
 the licensed certification authority must publish a signed 
 notice of the revocation in all repositories.  If a repository 
 no longer exists or refuses to accept publication, or if no 
 repository is recognized under section 325K.13, then the 
 licensed certification authority must also publish the notice in 
 a recognized repository. 

    Subd. 6.    When certification by subscriber ceases.  A 
 subscriber ceases to certify, as provided in section 325K.12, 
 and has no further duty to keep the private key secure, as 
 required by section 325K.13, in relation to the certificate 
 whose revocation the subscriber has requested, beginning at the 
 earlier of either: 

    (1) when notice of the revocation is published as required 
 in subdivision 5; or 

    (2) one business day after the subscriber requests 
 revocation in writing, supplies to the issuing certification 
 authority information reasonably sufficient to confirm the 
 request, and pays any contractually required fee. 

    Subd. 7.    Warranties discharged.  Upon notification as 
 required by subdivision 5, a licensed certification authority is 
 discharged of its warranties based on issuance of the revoked 
 certificate as to transactions occurring after the notification 
 and ceases to certify as provided in section 325K.11, 
 subdivisions 2 and 3, in relation to the revoked certificate. 

    Subd. 8.    Administrative procedures.  For purposes of 
 this section, the provisions of chapter 14 do not apply when the 
 secretary acts as a licensed certification authority for 
 governmental entities. 

    HIST: 1997 c 178 s 16; 1998 c 321 s 25,26; 1999 c 250 art 1 s 
 100; 1Sp2001 c 9 art 15 s 32