Electronic Communications and Transactions [No. 4 of 2021 155 PART V CERTIFICATION AUTHORITY 38. A certification authority shall utilise a trustworthy system in performing its services. 39. (1) A certification authority shall disclose— (a) its certificate that contains the public key corresponding to the private key used by that certification authority to digitally sign another certificate; (b) a certification practice statement as prescribed; (c) notice of the revocation or suspension of certificate; and (d) any other fact that materially and adversely affects either the reliability of a certificate that the authority has issued or the authority’s ability to carry out its obligations. (2) In the event of an occurrence that materially and adversely affects a certification authority’s trustworthy system or its certificate, the certification authority shall— (a) use reasonable efforts to notify any person who is known or likely to be affected by that occurence. (b) act in accordance with procedures governing such an occurrence as specified in its certification practice statement. 40. (1) A certification authority shall conduct an information system audit annually and submit the audit report to the National Root Certification Authority. Trustworthy system Disclosure and compliance with certification practice statement Audit services (2) Despite subsection (1), the National Root Certification Authority may require a certification authority to conduct an information system audit as and when the Authority considers it necessary at the cost of the certification authority. 41. (1) A certification authority shall maintain a certificate revocation list. (2) A certification authority that contravenes subsection(1) commits an offence and is liable, on conviction, to a fine not exceeding five hundred thousand penalty units. 42. A person shall not publish a certificate or otherwise make it available to another person if— (a) that person is not the certification authority listed in that certificate; (b) the subscriber listed in that certificate has not accepted it; or Publication of certificate revocation list Prohibition of publication of certificate