Skip to content

Banking and Insurance - Laws and Practice · Digital Banking

Suspension and Revocation of Digital Signature Certificate

Updated 11 October 2026 · Fact-checked

Under Sections 37 and 38 of the IT Act, 2000, a Certifying Authority can suspend a Digital Signature Certificate on request or in public interest, for at most fifteen days without a hearing. It can revoke it on specified grounds, but only after hearing the subscriber. Both must be communicated and published.

Understand Suspension and Revocation of Digital Signature Certificate

A Digital Signature Certificate (DSC) links a subscriber to a public key. Banks, companies and the public rely on it. So the law lets the Certifying Authority (CA) that issued it stop its use when something goes wrong.

There are two tools. Suspension is a temporary stop. Revocation ends the certificate for good. Section 37 deals with suspension and Section 38 with revocation.

Under Section 37(1), the CA that issued the certificate may suspend it in two situations. First, on a request from the subscriber named in it, or from a person duly authorised to act for that subscriber. Second, if the CA thinks suspension is needed in public interest.

The hearing rule is what examiners test. Under Section 37(2), a DSC cannot be suspended for more than fifteen days unless the subscriber has been given an opportunity of being heard. So a short suspension needs no hearing, but a longer one does. Revocation is stricter: Section 38(3) says it cannot happen unless the subscriber has been heard.

After either action, the CA must communicate it to the subscriber (Sections 37(3) and 38(4)). It must also publish a notice in the repository specified in the certificate, and in all repositories if more than one is specified (Section 39). Publishing or sharing a certificate knowing it is revoked or suspended is an offence under Section 73, except to verify a signature made before the suspension or revocation.

Key rules to remember

Who can request suspension (Section 37(1)(a))
Subscriber listed in the DSC, or a person duly authorised to act on the subscriber's behalf
Only the CA that issued the certificate can suspend it.
Suspension in public interest (Section 37(1)(b))
CA is of opinion that suspension is needed in public interest
No request from the subscriber is needed here.
Limit on suspension (Section 37(2))
Suspension beyond 15 days ⇒ subscriber must be given an opportunity of being heard
Fifteen days or less does not require a hearing under this sub-section.
Communication on suspension (Section 37(3))
CA must communicate the suspension to the subscriber
Applies on every suspension.
Revocation on request or event (Section 38(1))
Subscriber or authorised person requests; or subscriber dies; or firm dissolved or company wound up
Revocation is by the CA that issued the DSC.
Revocation by CA's opinion (Section 38(2))
Material fact false or concealed; issue requirement not satisfied; CA's private key or security system compromised materially; subscriber declared insolvent or dead, or firm or company dissolved, wound up or ceased to exist
Subject to Section 38(3).
Hearing before revocation (Section 38(3))
No revocation unless subscriber has been given an opportunity of being heard
Applies to revocation under Section 38(2).
Communication on revocation (Section 38(4))
CA must communicate the revocation to the subscriber
Mirrors Section 37(3).
Publication of notice (Section 39)
Notice in the repository specified in the DSC; in all repositories if more than one
Duty of the CA for both suspension and revocation.
Penalty for publishing a suspended or revoked certificate (Section 73)
Imprisonment up to 2 years, or fine up to ₹1,00,000, or both
Exception: publication to verify a signature created before the suspension or revocation.

How to solve Suspension and Revocation of Digital Signature Certificate questions

Use this method for any fact-based question on suspension or revocation of a DSC.

  1. 1Identify the action: is it suspension (temporary) or revocation (permanent)? Check the facts for words like 'temporarily' or 'cancelled'.
  2. 2Check who acted. Only the CA that issued the certificate can suspend or revoke it.
  3. 3Match the ground. For suspension: request by subscriber or authorised person, or public interest. For revocation: Section 38(1) or 38(2) grounds.
  4. 4Check the time and hearing. If suspension exceeds fifteen days, was the subscriber heard? For revocation, was the subscriber heard at all?
  5. 5Check the follow-up duties: communication to the subscriber and publication in the repository or all repositories (Section 39).
  6. 6Check misuse by third parties. If someone published or shared the certificate knowing it was suspended or revoked, apply Section 73.
  7. 7Write the conclusion: state whether the action was valid, what defect exists, and what the CA should do.

Quickest way: Four-check method for DSC questions

When to use it: Use when time is short and the question asks whether a CA's action is valid.

  1. Who: issuing CA only.
  2. Why: is the ground listed in Section 37(1) or Section 38?
  3. Hearing: over 15 days of suspension needs a hearing; revocation always needs a hearing.
  4. Notice: inform the subscriber and publish in all specified repositories.

Common mistakes in Suspension and Revocation of Digital Signature Certificate

  • Saying a DSC can never be suspended without a hearing.

    Students merge the suspension rule with the revocation rule.

    Fix: Suspension up to fifteen days needs no hearing. Only a longer suspension needs one. Revocation always needs a hearing.

  • Saying the fifteen-day limit is an absolute cap.

    The words 'shall not be suspended for a period exceeding fifteen days' sound like a ceiling.

    Fix: The limit applies 'unless the subscriber has been given an opportunity of being heard'. With a hearing, suspension can continue.

  • Letting any authority suspend or revoke the certificate.

    Students think of the Controller or the government as the decision-maker.

    Fix: Sections 37 and 38 give the power to the Certifying Authority that issued the certificate.

  • Mixing up suspension of a DSC with suspension of a CA's licence.

    Sections 25 and 37 both use the word suspension and both have a time limit.

    Fix: A licence is suspended by the Controller, with a ten-day limit before a show-cause opportunity (Section 25). A DSC is suspended by the CA, with a fifteen-day limit before a hearing (Section 37).

  • Forgetting the notice duties.

    Students stop at the grounds and the hearing.

    Fix: Always add communication to the subscriber and publication in the repository under Section 39.

  • Treating every use of a suspended certificate as an offence.

    Section 73 is remembered only as a penalty.

    Fix: Section 73 exempts publication made to verify a signature created before the suspension or revocation.

Worked examples

Example 1

Rohan Mehta, a director of Sunrise Finserve Ltd, loses the token holding his DSC. He asks the Certifying Authority to suspend it on 1 March. The CA suspends it and keeps it suspended for 20 days without hearing him. Advise on the validity of the CA's action.

Show the solution
  1. Provision: Section 37(1)(a) allows the CA to suspend on the subscriber's request. Rohan's request is a valid ground.
  2. The suspension itself is therefore valid.
  3. Section 37(2): suspension cannot exceed fifteen days unless the subscriber is given an opportunity of being heard.
  4. The CA kept the certificate suspended for 20 days, which is 5 days beyond the limit, without hearing him.
  5. Section 37(3) also requires the CA to communicate the suspension to Rohan, and Section 39 requires publication of notice in the specified repository or repositories.

Answer: Suspension was valid for the first fifteen days. Continuing it to 20 days without giving Rohan an opportunity of being heard breaches Section 37(2). The CA should have heard him before going beyond fifteen days. It must also communicate and publish the notice.

Example 2

Anjali Traders Pvt Ltd is wound up. Its Certifying Authority wants to revoke the DSC issued to the company. The CA revokes it immediately without notice to anyone. Examine the legality.

Show the solution
  1. Ground: Section 38(1)(c) permits revocation on winding up of a company that is the subscriber. Section 38(2)(d) also covers a company that is wound up or has ceased to exist.
  2. The ground exists, so the CA has power to revoke.
  3. Hearing: Section 38(3) says a DSC shall not be revoked unless the subscriber has been given an opportunity of being heard.
  4. The CA gave no notice, so the hearing requirement is not met. In practice the company is represented by its liquidator, who should be given the chance.
  5. After revocation, Section 38(4) requires the CA to communicate it to the subscriber, and Section 39 requires publication in the repository specified in the DSC, or in all repositories if more than one.
  6. After revocation, Section 73 bars anyone from publishing the certificate knowing it is revoked, except to verify an earlier signature.

Answer: The ground for revocation is valid, but revoking without giving the subscriber an opportunity of being heard breaches Section 38(3). The CA must also communicate the revocation and publish notice under Section 39.

Exam tips

  • Write the section number with each point: 37 for suspension, 38 for revocation, 39 for notice, 73 for penalty.
  • Always state the fifteen-day rule with its condition: a hearing is needed only beyond fifteen days.
  • In case questions, structure your answer as provision, facts, conclusion, and end with the CA's compliance steps.
  • Contrast suspension and revocation in two lines if the question asks for the difference: temporary versus permanent, and hearing only after fifteen days versus hearing always.
  • Do not mix up the ten-day licence suspension (Section 25) with the fifteen-day DSC suspension.

Practice questions from Digital Banking

Suspension and Revocation of Digital Signature Certificate in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Suspension and Revocation of Digital Signature Certificate: frequently asked questions

How long can a digital signature certificate be suspended?

Under Section 37(2), it cannot be suspended for more than fifteen days unless the subscriber has been given an opportunity of being heard. With a hearing, the suspension can continue beyond that.

What is the difference between suspension and revocation of a DSC?

Suspension is temporary and can be made on the subscriber's request or in public interest. Revocation ends the certificate and rests on the grounds in Section 38. Revocation always needs a hearing, while suspension needs one only beyond fifteen days.

Who can suspend a digital signature certificate?

Only the Certifying Authority that issued it. It may act on a request from the subscriber or a person duly authorised by the subscriber, or if it thinks suspension is in public interest.

Does the CA have to tell anyone about a suspension?

Yes. It must communicate the suspension to the subscriber under Section 37(3). It must also publish a notice in the repository specified in the certificate, and in all repositories if there are several, under Section 39.