Prior to providing services for issuing certificates, a certification authority shall file the certification practice statement stating its operational processes related to the practice or certification services of the certification authority to the competent authority for approval. The same rule shall also apply in the event that there is any modification in the certification practice statement.
The certification authority shall publish the approved certification practice statement on its website to the general public for reference. The same rule shall also apply in the event that there is any modification in the certification practice statement.
The competent authority shall announce a list of certification authorities whose certification practice statements have been approved, and the versions and the approval numbers of their certification practice statements.
A certification practice statement under Paragraph 1 shall state the following matters, of which specific contents of the following matters shall be announced by the competent authority.
(1) significant information that could affect the trustworthiness of a certificate issued by the certification authority or the certification authority's operation;
(2) grounds for the certification authority to revoke a certificate without being requested;
(3) retention of the information related to the verification of the content of a certificate;
(4) methods and procedures implemented to protect the personal data; and
(5) other important information mandated by the competent authority.

Prior to termination of its services, a certification authority shall complete the following measures:
(1) notice shall be given to the competent authority at least thirty days prior to the termination.
(2) any service relevant to a certificate that is still valid at the time of termination shall be assigned to another certification authority to take over.
(3) notice of termination of services and the assignment of valid certificates to another certification authority shall be given to the parties at least thirty days prior to the termination.
(4) the certification authority shall transfer its archives and records to the assigned certification authority.
In the event that no other certification authority is willing to take over the services pursuant to the second subparagraph in the first paragraph of this article, the competent authority may appoint a certification authority to take over. If necessary, the competent authority may revoke any certificate that is still valid at the time by public announcement.
The preceding paragraph is also applicable to the certification authority whose operation has been suspended pursuant to this Act or otherwise.

A certification authority shall be liable for any damage caused by its operation or other certification-related process to the parties, or to a bona fide person who relies on the certificate, unless the certification authority proves that it has not acted negligently.
Where a certification authority clearly specifies the limitation for the use of the certificate, it shall not be liable for any damage arising from a contrary use.

Under the principles of equivalent secure requirements and conforming to international reciprocity or technical interoperability and cooperation, a certificate issued by a certification authority organized or registered pursuant to foreign law shall be equivalent to the one issued by a domestic certification authority, provided that the foreign certification authority has been approved by the competent authority.
In respect of permission under the preceding paragraph, the regulations on application procedure, examination method, approval conditions, cause for revocation of approval, and other relevant matters shall be prescribed by the competent authority.
The competent authority shall announce a list of the certification authorities approved pursuant to the first paragraph.