(title available in French only)
Official Binding
Note
ETSI standard, part 2, setting the policy and security requirements for providers that issue EU qualified certificates (version 2.6.1).
The full text is not reproduced here (copyright): see the official source.
Summary
Purpose
European standard ETSI EN 319 411-2 (version 2.6.1, June 2025) sets the policy and security requirements for the issuance, maintenance and life-cycle management of EU qualified certificates within the meaning of Regulation 910/2014 ETSI EN 319 411-2 V2.6.1, § 1 Scope ETSI EN 319 411-2 V2.6.1, History. Its scope begins as follows:
The present document specifies policy and security requirements for the issuance, maintenance and life-cycle management of EU qualified certificates as defined in Regulation (EU) No 910/2014
It covers certificates issued to natural persons and to legal persons, including those associated with a website, and refers to ETSI EN 319 411-1 for the general requirements ETSI EN 319 411-2 V2.6.1, § 1 Scope ETSI EN 319 411-1 V1.4.1.
Who it applies to
To qualified trust service providers that issue qualified certificates for electronic signatures, electronic seals or website authentication Art. 1 List of reference standards for qualified certificates for website authentication.
Key points
- Seven certificate policies: QCP-n and QCP-l (natural persons, legal persons), QCP-n-qscd and QCP-l-qscd (private key in a qualified signature or seal creation device, QSCD), QEVCP-w, QNCP-w and QNCP-w-gen (website authentication) ETSI EN 319 411-2 V2.6.1, § 5.3 Certificate Policy name and identification.
- Policy identifier: the certificate carries the identifier of the policy under which it is issued and maintained, which helps the relying party judge whether it is suitable ETSI EN 319 411-2 V2.6.1, § 5.3 Certificate Policy name and identification.
- Provider’s practice: identification, life cycle, controls, profiles, audits ETSI EN 319 411-2 V2.6.1, § 6 Trust Service Providers practice.
What the acts apply, and how
- Implementing Regulation 2025/1943: Annex I (signature) and Annex II (seal) make EN 319 411-2 version 2.6.1 and profiles of EN 319 412 applicable, subject to adaptations Annex I Annex II. For EN 319 411-2, they replace normative references (EN 319 401 version 3.1.1, EN 319 411-1 version 1.5.1, itself adapted) and rewrite requirements: identity verification under the implementing acts provided for by the regulation Art. 24(1c), termination plan, agreed cryptographic mechanisms published by ENISA, certified cryptographic device (Common Criteria or EUCC at level EAL 4 or higher, or FIPS PUB 140-3 level 3 until 31 December 2030), quarterly vulnerability scanning and annual penetration testing Annex I ETSI EN 319 401 V3.1.1 ETSI EN 319 411-1 V1.5.1. A qualified certificate that complies with these standards is presumed to comply with the requirements of Annex I (signature) or Annex III (seal) to the regulation Art. 28(6) Art. 38(6). A recital adds that supervisory bodies should presume such compliance, the provider being able to demonstrate it through other practices laying down rules for the application of Regulation (EU) No 910/2014 of the European Parliament and of the Council as regards reference standards for qualified certificates for electronic signatures and qualified certificates for electronic seals.
- Implementing Regulation 2025/2527: for qualified certificates for website authentication used for transport layer security outside a browser, the annex accepts EN 319 411-2 version 2.6.1 with one of the policies QNCP-w-gen, QEVCP-w or QNCP-w, or ETSI TS 119 495 version 1.7.1; for the others, including in a browser, it refers to ETSI TS 119 411-5 version 2.1.1 List of reference standards for qualified certificates for website authentication ETSI TS 119 495 V1.7.1 ETSI TS 119 411-5 V2.1.1. This regulation applies from 6 January 2027 Art. 2. Regulation 910/2014 does not provide for a presumption here, but for an evaluation carried out under these standards:
The evaluation of compliance with those requirements shall be carried out in accordance with the standards, specifications and procedures referred to in paragraph 2 of this Article.
- Implementing Regulation 2025/2162: Annex II cites EN 319 411-2, without a version, for the three services issuing qualified certificates; the owners of conformity assessment schemes ensure that their schemes state the year and version number of the standards Annex II Art. 6(3).
- Implementing Regulation 2025/1942: where validation reports are signed, the provider’s signing certificate should be issued under a policy of EN 319 411-2, cited without a version (informative reference [i.17] of ETSI TS 119 441, which the annex adapts) Annex ETSI TS 119 441 V1.2.1.
Cited version
The annexes to Implementing Regulation 2025/1943 name ETSI EN 319 401 in version 3.1.1 among the references of EN 319 411-2 Annex I ETSI EN 319 401 V3.1.1. The latest published version of that standard, 3.2.1, is also in the corpus ETSI EN 319 401 V3.2.1. The annex to Implementing Regulation 2025/2527 also names ETSI TS 119 495 in version 1.7.1 List of reference standards for qualified certificates for website authentication. The index of ETSI standards in the corpus, consulted on 31 October 2026, mentions a more recent published version, V1.8.1, whose text is not in the corpus.
Error in the act
In Annexes I and II to Implementing Regulation 2025/1943, requirement GEN-6.5.2-02 refers, for the Common Criteria route, to “version CC:2002, Parts 1 through 5”; the English version carries the same wording Annex I Annex II. This is probably version CC:2022; this reading is ours, not an official correction.
Error in the act
In the French version of Implementing Regulation 2025/1943, the title of Annex II refers to qualified certificates “de signature électronique” (for electronic signatures), like Annex I; the English version refers to electronic seals, and the regulation links Annex II to the provision of Regulation 910/2014 on qualified certificates for electronic seals
Annex IIArt. 1Important clauses
- ETSI EN 319 411-2 V2.6.1, § 1 Scope: scope.
- ETSI EN 319 411-2 V2.6.1, § 5.3 Certificate Policy name and identification: qualified certificate policies.
- ETSI EN 319 411-2 V2.6.1, § 6.2 Identification and Authentication: identification and authentication.
- ETSI EN 319 411-2 V2.6.1, Annex A (informative): Regulation and EU qualified certificate policy mapping: mapping to the regulation.
Links
- General requirements: ETSI EN 319 411-1 ETSI EN 319 411-1 V1.4.1 ETSI EN 319 411-1 V1.5.1.
- Certificate profiles: ETSI EN 319 412-1, -2 and -3 ETSI EN 319 412-1 V1.6.1 ETSI EN 319 412-2 V2.4.1 ETSI EN 319 412-3 V1.3.1.
- Learning path: step 4, trust services.
Consolidation without official value
This summary cites the consolidated version, published on EUR-Lex, of Regulation 910/2014 Regulation (EU) No 910/2014 — consolidated version of 18/10/2024. It serves as documentation: only the text published in the Official Journal is authentic.
ETSI standard: the site reproduces only short extracts; the full text is available from ETSI ETSI EN 319 411-2 V2.6.1. Written by Asphalia.