Section 30

Section 30 sets out the operational obligations of licensed Certifying Authorities — the day-to-day standards they must maintain to keep their licence and ensure the integrity of India's digital signature ecosystem. The duties cluster into three areas. First, technical security: CAs must use hardware and software secure from intrusion (clause a), maintain reliable services (clause b), and apply security procedures protecting electronic signature secrecy (clause c). In practice this means mandatory use of FIPS 140-2 certified Hardware Security Modules for CA private key storage, redundant infrastructure with documented disaster recovery, intrusion detection systems, and regular third-party security audits. Second, repository and disclosure duties: each CA must maintain a repository of all certificates it issues (clause d) and publish its practices and certificate information per CCA regulations (clause e). The published document — the Certification Practice Statement (CPS) — is the CA's public commitment to its security practices, liability limits, and subscriber terms. Relying parties and subscribers can inspect the CPS to understand what assurances the CA provides. Third, compliance with CCA standards: CAs must observe any additional standards specified by CCA regulations (clause f), which have included OCSP implementation, annual audit requirements, and incident reporting timelines.