This section addresses the rights and obligations of the entities whose rights and obligations are intended to be controlled by this CPS (see definition of "parties") regarding the use of digital signatures and digitally signed messages corresponding to VeriSign-issued certificates.
The parties (IA and the parties who are "users" of the certificate, i.e., the subscriber and the relying parties), are hereby notified of the following rules governing the respective rights and obligations of the parties among themselves, which are also deemed to be agreed by the parties, effective (i) upon publication of this CPS in the case of the IA; (ii) upon submission of an application for a certificate, in the case of an applicant or subscriber; and (iii) upon reliance of a certificate or a digital signature verifiable with reference to a public key listed in the certificate, in the case of a recipient of a certificate or a relying party.
8.1 Verification of Digital Signatures
8.2 Effect of Validating an End-User Subscriber Certificate
8.3 Procedures Upon Failure of Digital Signature Verification
8.4 Reliance on Digital Signatures
8.5 Writings
8.6 Signatures
8.7 Security Measures
8.8 Issuing Certificates
Verification of a digital signature, is undertaken to determine that (i) the digital signature was created by the private key corresponding to the public key listed in the signer's certificate and that (ii) the associated message has not been altered since the digital signature was created.
Such verification shall be undertaken in a manner consistent with this CPS, as follows:
A digital signature is binding against its maker if it (i) was created during the operational period of a valid certificate, (ii) such digital signature can be properly verified by confirmation of certificate chain (iii) the relying party has no knowledge or notice of a breach of the requirements of this CPS by the signer, and (iv) the relying party has complied with all requirements of this CPS.
THE USE OF CERTIFICATES DOES NOT CONVEY EVIDENCE OF AUTHORITY ON THE PART OF ANY USER TO ACT ON BEHALF OF ANY PERSON OR TO UNDERTAKE ANY PARTICULAR ACT. VERIFIERS OF DIGITALLY SIGNED MESSAGES ARE SOLELY RESPONSIBLE FOR EXERCISING DUE DILIGENCE AND REASONABLE JUDGMENT BEFORE RELYING ON CERTIFICATES AND DIGITAL SIGNATURES. A CERTIFICATE IS NOT A GRANT FROM AN IA OF ANY RIGHTS OR PRIVILEGES, EXCEPT AS SPECIFICALLY PROVIDED IN THIS CPS.
A person relying on an unverifiable digital signature assumes all risks with regard to it and is not entitled to any presumption that the digital signature is effective as the signature of the subscriber under CPS Sections 8.4-8.6.
A recipient of a message signed by a digital signature of the subscriber may rely upon that digital signature as binding against the subscriber if:
(i) the digital signature was created during the operational period of a valid certificate and it can be verified by referencing a validated certificate chain, and
(ii) such reliance is reasonable under the circumstances. If the circumstances indicate a need for additional assurances, the relying party must obtain such assurances for such reliance to be reasonable.
Additionally, the verifier should consider the class of certificate and the state of a certificate (normal or provisional). The final decision concerning whether or not to rely on a verified digital signature is exclusively that of the verifier.
A message bearing a digital signature verified by the public key listed in a valid certificate is as valid, effective, and enforceable as if the message had been written and signed on paper.
Where a rule of law or applicable practice requires a signature or provides for certain consequences in the absence of a signature, that rule is satisfied in relation to a message by a digital signature affixed by a signer with the intention of signing a message and subsequently verified by reference to the public key listed in a valid certificate.
Any person using or relying upon a VeriSign PCS-issued certificate in conjunction with a message shall apply reasonable security measures to the message to provide message authentication and, as required, to support data confidentiality.
Only authorized IAs may issue certificates.