1. 1.

   1. (1) Unless the certification authority and the subscriber agree otherwise, the licensed certification authority which issued a certificate which is not a transactional certificate shall suspend the certificate for a period not exceeding forty-eight hours:

      1. (a) Upon request by a person identifying himself or herself as the subscriber named in the certificate, or as a person in a position likely to know of a compromise of the security of the* subscriber's private key, such as an agent, business associate, employee or member of the immediate family of the subscriber; or
      2. (b) By order of the division pursuant to subsection 5 of section 28.627;
   2. (2) The certification authority need not confirm the identity or agency of the person requesting suspension pursuant to paragraph (a) of subdivision (1) of this subsection.

2. 2.

   1. (1) Unless the certificate provides otherwise or the certificate is a transactional certificate, the division, a court clerk, or county clerk may suspend a certificate issued by a licensed certification authority for a period of forty-eight hours, if:

      1. (a) A person requests suspension and identifies himself or herself as the subscriber named in the certificate or as an agent, business associate, employee or member of the immediate family of the subscriber; and
      2. (b) The requester represents that the certification authority which issued the certificate is unavailable;

   2. (2) The division, court clerk or county clerk may:

      1. (a) Require the person requesting suspension pursuant to subdivision (1) of this subsection to provide evidence, including a statement under oath or affirmation, regarding any information described in subdivision (1) of this subsection; and
      2. (b) Suspend or decline to suspend the certificate in its discretion;
   3. (3) The division, attorney general or county attorney may investigate suspensions by the division, a court clerk or a county clerk for possible wrongdoing by persons requesting suspension pursuant to subdivision (1) of this subsection.

3. 3.

   1. (1) Immediately upon suspension of a certificate by a licensed certification authority, the licensed certification authority shall publish notice, signed by the licensed certification authority, of the suspension in any repositories specified in the certificate for publication of notice of suspension. If any repository specified in the certificate no longer exists or refuses to accept publication, or is no longer recognized pursuant to section 28.672, the licensed certification authority shall publish the notice in any recognized repository;
   2. (2) If a certificate is suspended by the division, a court clerk or county clerk, the division or clerk shall give notice as required in subdivision (1) of this subsection for a licensed certification authority, provided that the person requesting suspension pays in advance any fee required by a repository for publication of the notice of suspension.

4. 4. A certification authority shall terminate a suspension initiated by request only:

   1. (1) If the subscriber named in the suspended certificate requests termination of the suspension and the certification authority has confirmed that the person requesting suspension is the subscriber or an agent of the subscriber authorized to terminate the suspension; or
   2. (2) When the certification authority discovers and confirms that the request for the suspension was made without authorization by the subscriber, provided that this subdivision does not require the certification authority to confirm a request for suspension.
5. 5. The contract between a subscriber and a licensed certification authority may limit or preclude requested suspension by the certification authority, or may provide otherwise for termination of a requested suspension. However, if the contract limits or precludes suspension by the division, a court clerk or a county clerk when the issuing certification authority is unavailable, the limitation or preclusion shall be effective only if notice of the limitation or preclusion is published in the certificate.
6. 6. A person may not knowingly or intentionally misrepresent to a certification authority his or her identity or authorization in requesting suspension of a certificate. Violation of this subsection is a class B misdemeanor.
7. 7. While the certificate is suspended, the subscriber is released from the duty to keep the private key secure pursuant to subsection 1 of section 28.636.

(L. 1998 S.B. 680 § 14)

* Word "the" does not appear in original rolls.