Internet X.509 PKI: Qualified Certificates Profile

Note

IETF specification defining an identity certificate profile for natural persons, with conventions for qualified certificates, without defining their legal requirements.

Summary

Purpose

IETF RFC 3739 (March 2004) defines an X.509 certificate profile for identity certificates issued to natural persons, based on RFC 3280 RFC 3739, Abstract. It provides conventions specific to “qualified” certificates within a given legal framework, but:

It profiles two certificate fields (issuer and subject) and four extensions of RFC 3280, and it defines two new extensions: biometric information and qualified certificate statements (qcStatements) RFC 3739, § 1. Introduction.

Who it applies to

The RFC itself imposes nothing under eIDAS. Two acts in the corpus refer to it, each in its own way.

• Qualified time-stamping. The annex to Implementing Regulation 2025/1929 adapts clause 9.1 of standard ETSI EN 319 422: if the time-stamping authority (TSA) declares a token to be a qualified electronic time stamp, that token must contain the qcStatements extension, with the syntax of clause 3.2.6 of the RFC List of reference standards and specifications for qualified time stamp services. Under Regulation 910/2014, the binding of date and time to data and the accuracy of the time source are presumed to comply with the requirements laid down in paragraph 1 of the same article where they comply with the standards, specifications and procedures referred to in paragraph 2 Art. 42(1a); these are the ones in the annex Art. 1.
• Trusted lists. Implementing Decision 2015/1505 requires Member States to have trusted lists that comply with its Annex I Art. 1. Where a human-readable version of the list is established and published, it must display at least certain certificate fields, including the “Qualified Certificate Statements”; a footnote refers, for this field, to RFC 3739 Annex I.

Key points

• An optional extension. The RFC defines the qcStatements extension as optional; each statement carries an object identifier (OID) and may carry additional data RFC 3739, § 3.2.6. Qualified Certificate Statements.
• Critical or non-critical. For the RFC, the extension may be critical or non-critical RFC 3739, § 3.2.6. Qualified Certificate Statements. For the qualified time-stamp token, the act decides: it must not be marked as critical List of reference standards and specifications for qualified time stamp services.
• The content of the statements. A statement may indicate that the certificate is issued as a qualified certificate under a particular legal system, or relate to the applicable jurisdiction RFC 3739, § 3.2.6. Qualified Certificate Statements.
• The statement required by the act. In the qualified time-stamp token, the extension must contain the statement “esi4-qtstStatement-1” defined in Annex B of standard EN 319 422 List of reference standards and specifications for qualified time stamp services.
• Qualification remains a legal matter. The mechanisms that decide whether a certificate should be considered “qualified” under a given legislation are outside the scope of the RFC RFC 3739, § 2. Requirements and Assumptions.

Clauses referred to by the acts

• Clause 3.2.6 (qualified certificate statements): syntax imposed on the qualified time-stamp token by the adaptation of clause 9.1 of standard EN 319 422, with two clarifications from the act (statement “esi4-qtstStatement-1”, non-critical extension) List of reference standards and specifications for qualified time stamp services.
• Implementing Decision 2015/1505: general reference to the RFC, through a footnote, without a clause number, for a field to be displayed in the human-readable version Annex I.

Links

• Acts that refer to it: Implementing Regulation 2025/1929 Implementing Regulation (EU) 2025/1929 and Implementing Decision 2015/1505 Implementing Decision (EU) 2015/1505 — consolidated version of 29/04/2026.
• Intermediate standard: ETSI EN 319 422 ETSI EN 319 422 V1.1.1.
• Related standards: RFC 5280, X.509 certificate profile RFC 5280; RFC 3161, time-stamp protocol RFC 3161.
• Learning path: step 4, trust services.

Written by Asphalia.