Is a subscription for digital-certificate authentication and resolution services (secure-website certificates) subject to NY sales tax?

Plain-English summary

The petitioner provides authentication solutions for secure Internet commerce. On a subscription basis it issues a "digital certificate" (an SSL-type certificate) and performs authentication and resolution services. When a website operator (the customer) applies, the company performs due diligence to verify the operator's identity, business, and domain, then issues a digital certificate -- a flat file (no code) containing the customer's public key, expiration date, owner/issuer names, a serial number, and the issuer's electronic signature. The customer installs it on its web server. When a visitor's browser connects, it checks the certificate so it can recognize the site as genuine and open an encrypted session; the "resolution" service lets the browser confirm in real time that the certificate is still valid and not revoked. The encryption/decryption software already resides in the visitor's browser and the customer's server -- the company doesn't supply it. The company asked whether its authentication service is taxable.

The Office of Counsel concluded it is not taxable:

• No tangible personal property. Sales tax reaches tangible personal property, including prewritten software (Tax Law 1101(b)(6)). But the company provides no tangible property: the certificate and services are delivered electronically, the digital certificate is not software (it's a flat file containing no code), and the company supplies no software -- the encryption software already lives on the customer's server and the visitor's browser.
• Not an enumerated service. Sales tax also reaches certain enumerated services under Tax Law 1105(c). The company's authentication/resolution service is not among them (TSB-A-00(7)S).

So the lump-sum subscription for authentication, the digital certificate, and resolution is not subject to State or local sales or use tax.

What this means for you

Providers of digital certificates, identity verification, and security services

A service that mainly verifies identity and issues a non-software data file, delivered electronically, is generally not taxable in New York -- there's no tangible personal property (a certificate with no code isn't software) and identity/authentication services aren't enumerated. Two cautions: if you actually furnish prewritten software (rather than relying on software already on the customer's systems), or if your offering is really a taxable enumerated service (e.g., a protective/monitoring service or an information service), the analysis can change. Here, the keys were that the company supplied no software and the certificate contained no code.

Customers

Subscriptions for SSL/identity certificates of this kind shouldn't carry New York sales tax.

Common questions

Q: Is a digital/SSL certificate taxable software?
A: No. A certificate that's a flat file with no code isn't software -- and here the provider supplies no software at all, so there's no taxable tangible personal property.

Q: What about the authentication and resolution service?
A: Not taxable. It isn't one of the services enumerated as taxable under Tax Law 1105(c).

Q: When could a service like this be taxable?
A: If the provider actually furnishes prewritten software, or if the offering is really a taxable enumerated service (such as a protective or information service).

Citations and references

• Tax Law section 1105(a) (sales tax on tangible personal property)
• Tax Law section 1101(b)(6) (prewritten software as tangible personal property)
• Tax Law section 1105(c) (enumerated services)

Source

• Landing page: https://www.tax.ny.gov/pubs_and_bulls/advisory_opinions/sales_ao_2011.htm
• Opinion: https://www.tax.ny.gov/pdf/advisory_opinions/sales/a11_14s.pdf

Original ruling text

New York State Department of Taxation and Finance

TSB-A-11(14)S
Sales Tax
May 3, 2011

Office of Counsel
Advisory Opinion Unit
STATE OF NEW YORK
COMMISSIONER OF TAXATION AND FINANCE
ADVISORY OPINION

PETITION NO. S100928A

Petitioner name and address redacted requests an Advisory Opinion about whether its sales of its
authentication service are subject to New York State and local sales and use taxes. We conclude that
Petitioner’s authentication service described below is not subject to State and local sales and use taxes.
Facts
Petitioner is a provider of authentication solutions for businesses and individuals seeking to
perform secure electronic commerce and communications over the Internet. One such solution is the
provision of a “digital certificate” and authentication and resolution services on a subscription basis.
Digital certificates are commonly used to facilitate secure transmissions between end users’
browsers and Petitioner’s customers’ servers. A digital certificate allows an end user to recognize that
they are accessing a customer’s website, rather than a fake website, because Petitioner’s trademarked logo
will appear on the real website, indicating that it has been authenticated by Petitioner. The trademarked
logo serves as a visible indication on the end user’s screen that the customer’s website is what it purports
to be.
A digital certificate is provided through an online process, which the customer initiates by
accessing Petitioner’s online portal and completing a registration form. As part of this process, a private
and public key pair is generated by the customer’s web server. The private key is retained by the
customer on its web server. The public key is part of the customer’s information sent to Petitioner during
the registration process.
Petitioner performs all due diligence necessary to authenticate the identity of the applicant, the
related website and business, and the information provided by the customer during the registration
process, including the public key (authentication service). There are two components of the
“authentication service.” The first authentication occurs when a customer requests a certificate. At that
time, the customer gives Petitioner certain information. The customer can request a level of
authentication from basic to advanced. Examples include verifying the existence of the customer’s
business, the ownership of the domain, and the requestor’s authority to apply for the certificate. This
process is completed by Petitioner’s “trust center,” and may involve Petitioner requesting a credit check
or other report on the customer, along with various proprietary techniques to verify the customer’s
information.
Once Petitioner authenticates the applicant’s identity, a digital certificate is sent to the customer
electronically. A digital certificate is a flat file (i.e., does not contain code) that includes: the customer’s
public key; metadata that includes the certificate expiration date; the certificate owner’s name; the name
of the issuer (in this case, Petitioner); serial number of the certificate; and an electronic signature of the
issuer. The exact contents of a certificate adhere to certain industry-established standards. The digital
certificate is installed by the customer on the customer’s web server.

-2-

TSB-A-11(14)S
Sales Tax
May 3, 2011

The second authentication component occurs when the end user’s web browser connects to a
secure website (web server). The browser requests that the server identify itself. The server sends the
browser a copy of its digital certificate. The browser checks the certificate’s authenticity by matching it
against a list that resides in the browser of all authentic certificate providers. If the browser establishes
the certificate’s authenticity, it initiates a secure transmission between it and the web server. All
subsequent transmissions between the browser and the web server are securely encrypted.
When an end user’s web browser attempts to communicate with a customer’s web server, a
secure link is established for that “session.” The end user’s web browser generates a unique “session
key” to encrypt the transmission between the customer’s server and the end user’s browser, so that a
secure communication can begin. The software to create a session key already resides in all web
browsers and is not supplied by Petitioner. However, before encrypted communications can begin, the
end user’s browser must transmit the session key to the web server so that both servers will know how to
encrypt and decrypt the transmission. To do this, the web browser uses a public key supplied by the web
server to encrypt the session key and sends the session key to the customer’s web server. The web server
uses its private key to decrypt the session key so that both the web server and browser can begin using the
session key to encrypt and decrypt all subsequent transmissions between the web server and the browser.
The keys are generated in pairs by the customer’s web server and are mathematically linked. Petitioner
does not provide the keys. The public key is made available by the customer’s web server through its
digital certificate. The private key is retained by the customer’s server. The encryption/decryption is
performed by cryptographic software built into the end user’s web browser and the customer’s server.
This software is not provided by Petitioner.
The resolution service is a process whereby the end user’s browser verifies that the digital
certificate is valid and has not been revoked. The web browser does this by contacting Petitioner’s server
in real time and Petitioner’s server tells the web browser if the certificate is current and not revoked.
Each certificate has a validity term, so a browser will validate that the certificate of the website it is
connecting to has not expired. The certificate can also be validated by contacting Petitioner’s server,
which checks the certificate against a list of revoked certificates. The second method may be used when
real-time servers are down.
The charges for the authentication service, digital certificate, and resolution service are part of a
lump sum subscription charge and must be renewed periodically.
Analysis
We conclude that Petitioner’s service is not subject to sales and use taxes. Sales tax is imposed
on receipts from every sale of tangible personal property. See Tax Law § 1105(a). Prewritten computer
software is included within the definition of tangible personal property, “regardless of the medium by
means of which such software is conveyed to the purchaser.” Tax Law § 1101(b)(6). Petitioner does not
provide customers with tangible personal property. The certificate and services are not provided in
tangible form; rather, they are delivered electronically. The digital certificate itself is not software and
does not contain code. Petitioner does not provide its customer with any software. The software used
during the encryption and decryption processes already resides on the customer’s server and the end
user’s browser.
Sales tax is also imposed upon the receipts from every sale, except sales for resale, of certain
enumerated services. See Tax Law § 1105(c). Petitioner’s service is not among the services enumerated

-3-

TSB-A-11(14)S
Sales Tax
May 3, 2011

under Section 1105(c) of the Tax Law. See TSB-A-00(7)S. Accordingly, Petitioner’s service is not
subject to State and local sales or use taxes.

DATED: May 3, 2011

NOTE:

/S/
DEBORAH LIEBMAN
Deputy Counsel

An Advisory Opinion is issued at the request of a person or entity. It is limited to the facts set
forth therein and is binding on the Department only with respect to the person or entity to
whom it is issued and only if the person or entity fully and accurately describes all relevant
facts. An Advisory Opinion is based on the law, regulations, and Department policies in effect
as of the date the Opinion is issued or for the specific time period at issue in the Opinion.