The citizen certificate consists of two certificates, an authentication and encryption certificate and a signature certificate, or qualified certificate. The signature certificate of citizen and organisation certificates issued by the Population Register Centre is a qualified certificate.
Qualified certificates must meet the requirements of the Act on Strong Electronic Identification and Electronic Signatures, Section 7(2). Qualified certificates are issues by a certification authority that meets the requirements of Sections 10–15 of the Act. On 1 April 2003, the Population Register Centre became the first and, so far, the only qualified certification authority in Finland. The Finnish Communications Regulatory Authority monitors qualified certification activities.
Digital signature is an electronic signature that is produced using an encryption method. An electronic signature certified by a qualified certification authority holds the same legal effect as a handwritten signature in all EU countries. An electronic signature created using a qualified certificate utilises Public Key Infrastructure (PKI). An e-mail programme, for example, turns messages that are encrypted using the signer’s private key into an encrypted digital signature. The message recipient, i.e. the party trusting the certificate, unlocks the signature using the public key sent by the sender. The software takes care of the identification and comparison. If the sent and received data match, the signature is authentic.
Qualified certificates must contain the following:
- data confirming that the certificate is a qualified certificate
- information about the certification authority and its country of location
- signer’s name or assumed name, which must make clear that it is an assumed name
- signature authentication data, which matches the signature creation data controlled by the signer
- validity of the qualified certificate
- unique code of the qualified certificate
- the certification authority’s advanced electronic signature
- any restrictions on use of the qualified certificate and special information on the signer if necessary for the purpose of the qualified certificate.
For more information about qualified certificates and certificate operation, please visit FICORA,s web site.