(title available in French only)
Official
Note
ETSI standard, part 1, setting the general policy and security requirements for providers that issue certificates (version 1.4.1).
The full text is not reproduced here (copyright): see the official source.
Summary
Purpose
European standard ETSI EN 319 411-1 (version 1.4.1, October 2023) sets the general policy and security requirements applicable to trust service providers that issue public key certificates, including website certificates ETSI EN 319 411-1 V1.4.1, § 1 Scope ETSI EN 319 411-1 V1.4.1, History. Its scope begins as follows:
The present document specifies generally applicable policy and security requirements for Trust Service Providers (TSPs) issuing public key certificates, including trusted web site certificates.
It refers to ETSI EN 319 401 for the requirements common to all providers and includes provisions consistent with those of the CA/Browser Forum ETSI EN 319 411-1 V1.4.1, § 1 Scope.
Who it applies to
To providers that issue certificates, qualified or not. For EU qualified certificates, ETSI EN 319 411-2 builds on this standard ETSI EN 319 411-1 V1.4.1, § 1 Scope ETSI EN 319 411-2 V2.6.1, § 1 Scope. Among the acts in the corpus consulted on 31 October 2026, version 1.4.1 is now named only in the text that Implementing Regulation 2026/1730 replaces (see below).
Key points
- Reference certificate policies: NCP (normalized policy), NCP+ (with a secure cryptographic device), LCP (lightweight), EVCP, DVCP, OVCP and IVCP (extended, domain, organization or individual validation) ETSI EN 319 411-1 V1.4.1, § 5.3 Certificate Policy name and identification.
- Certificate life cycle: identification and authentication, application, issuance, revocation, status services ETSI EN 319 411-1 V1.4.1, § 6.2 Identification and authentication ETSI EN 319 411-1 V1.4.1, § 6.3 Certificate Life-Cycle operational requirements.
- Controls: facilities, personnel, technical security, profiles of certificates, revocation lists and OCSP responses ETSI EN 319 411-1 V1.4.1, § 6.4 Facility, management, and operational controls ETSI EN 319 411-1 V1.4.1, § 6.5 Technical security controls ETSI EN 319 411-1 V1.4.1, § 6.6 Certificate, CRL and OCSP profiles.
- Other policies: a framework allows policies specific to a particular context to be defined ETSI EN 319 411-1 V1.4.1, § 7 Framework for the definition of other certificate policies.
What the acts apply, and how
Implementing Regulation 2025/848, on the registration of wallet-relying parties, required the policies and practice statements of access certificates and of relying party registration certificates to comply at least (for the former, where applicable) with the requirements of the normalized certificate policy of EN 319 411-1 version 1.4.1. Implementing Regulation 2026/1730 replaced these references: access certificates must now, where applicable, comply with ETSI TS 119 411-8 version 1.1.1, and registration certificates with ETSI TS 119 475 version 1.2.1
Annex II Annex IIIETSI TS 119 411-8 V1.1.1 ETSI TS 119 475 V1.2.1. The consolidated version of 2025/848 as at 11 August 2026 contains this new text Annex IV Annex V.
Other acts cite the same standard in another version or without a version:
- Implementing Regulations 2025/1943 (qualified certificates for signatures and seals) and 2025/1944 (qualified registered delivery) cite version 1.5.1 Annex I List of reference standards and specifications referred to in Article 1 ETSI EN 319 411-1 V1.5.1;
- Implementing Regulation 2025/1942 (qualified validation) cites it without a version: where validation reports are signed, the provider’s signing certificate is issued under the NCP+ policy Annex.
Cited version
Among the acts in the corpus, only the former text of 2025/848, reproduced by 2026/1730 in order to replace it, names version 1.4.1 Annex II. The latest published version is 1.5.1 (April 2025) ETSI EN 319 411-1 V1.5.1, History, cited by Implementing Regulations 2025/1943 and 2025/1944 Annex I List of reference standards and specifications referred to in Article 1.
Important clauses
- ETSI EN 319 411-1 V1.4.1, § 1 Scope: scope.
- ETSI EN 319 411-1 V1.4.1, § 5.3 Certificate Policy name and identification: policy identifiers.
- ETSI EN 319 411-1 V1.4.1, § 6 Trust Service Providers practice: provider’s practice.
Links
- Version 1.5.1 of the same standard ETSI EN 319 411-1 V1.5.1.
- EU qualified certificates: ETSI EN 319 411-2 ETSI EN 319 411-2 V2.6.1.
- General requirements for providers: ETSI EN 319 401 ETSI EN 319 401 V3.1.1.
- Learning path: step 4, trust services.
Consolidation without official value
This summary relies on the consolidated version, published on EUR-Lex, of Implementing Regulation 2025/848 Implementing Regulation (EU) 2025/848 — consolidated version of 11/08/2026. It serves as documentation: only the text published in the Official Journal is authentic.
ETSI standard: the site reproduces only short extracts; the full text is available from ETSI ETSI EN 319 411-1 V1.4.1. Written by Asphalia.