1. 1. A licensed certification authority may issue a certificate to a subscriber only after all of the following conditions are satisfied:

   1. (1) The certification authority has received a request for issuance signed by the prospective subscriber; and

   2. (2) The certification authority has confirmed that:

      1. (a) The prospective subscriber is the person to be listed in the certificate to be issued;
      2. (b) If the prospective subscriber is acting through one or more agents, the subscriber authorized the agent or agents to have custody of the subscriber's private key and to request issuance of a certificate listing the corresponding public key;
      3. (c) The information in the certificate to be issued is accurate after due diligence;
      4. (d) The prospective subscriber rightfully holds the private key corresponding to the public key to be listed in the certificate;
      5. (e) The prospective subscriber holds a private key capable of creating a digital signature; and
      6. (f) The public key to be listed in the certificate can be used to verify a digital signature affixed by the private key held by the prospective subscriber;
   3. (3) The requirements of this subsection may not be waived or disclaimed by the licensed certification authority or the subscriber.

2. 2.

   1. (1) If the subscriber accepts the issued certificate, the certification authority shall publish a signed copy of the certificate in a recognized repository agreed upon by the certification authority and the subscriber named in the certificate, unless the contract between the certification authority and the subscriber provides otherwise;
   2. (2) If the subscriber does not accept the certificate, a licensed certification authority shall not publish the certificate or shall cancel its publication if the certificate has already been published.
3. 3. Nothing in this section precludes a licensed certification authority from conforming to standards, certification practice statements, security plans, or contractual requirements more rigorous than, but consistent with, sections 28.600 to 28.678.

4. 4.

   1. (1) A licensed certification authority which has issued a certificate:

      1. (a) Shall revoke a certificate immediately upon confirming that it was not issued as required by this section; or
      2. (b) May suspend, for a reasonable period of time not to exceed forty- eight hours, a certificate which it has issued in order to conduct an investigation to confirm grounds for revocation pursuant to paragraph (a) of this subdivision;
   2. (2) The certification authority shall give notice of the revocation or suspension to the subscriber as soon as practicable.

5. 5.

   1. (1) The division may order the licensed certification authority to suspend or revoke a certificate which the certification authority issued if, after giving the certification authority and subscriber any required notice and opportunity for a hearing in accordance with chapter 536, RSMo, the division determines that:

      1. (a) The certificate was issued without substantial compliance with this section; and
      2. (b) The noncompliance poses a significant risk to persons reasonably relying on the certificate;
   2. (2) The division may suspend a certificate for a reasonable period of time not to exceed forty-eight hours upon determining that an emergency requires an immediate remedy.

(L. 1998 S.B. 680 § 10)