prospective subscriber; and
(b) complied with
(i) where it has a certification practice
statement, all the practices and proce
dures set out in the certification practice
statement, including procedures regard
ing identification of the prospective
subscriber, or
(ii) in the absence of a certification practice
statement, the conditions in subsection
(2).
(2) In the absence of a certification practice
statement, the certification authority shall only
issue a certificate to a prospective subscriber
where it has ascertained that
(a) the prospective subscriber is the person to
be referred to in the certificate to be issued;
(b) if the prospective subscriber is acting
through an agent, the subscriber authorized
the agent to have custody of the
subscriber's private key and to request the
issue of a certificate setting out the
corresponding public key;
(c) the information in the certificate to be
issued is accurate;
(d) the prospective subscriber rightfully holds
the private key corresponding to the public
key to be referred to in the certificate;
(e) the prospective subscriber holds a private
key capable of creating a digital signature;
and
(f) the public key to be referred to in the
certificate can be used to verify a digital
signature affixed by the private key held by
the prospective subscriber.
203