ETSI EN 319 412-4 V1.4.1

(title available in French only)

Official Binding

Reference: ETSI EN 319 412-4 V1.4.1
Type: ETSI standard
Folder: ETSI standards
Version: V1.4.1
Date: 2025-06
Status: Final
Languages: English
Official source: https://www.etsi.org/deliver/etsi_en/319400_319499/31941204/01.04.01_60/en_31941204v010401p.pdf

Note

ETSI standard, part 4, specifying a certificate profile for website certificates accessed via the TLS protocol, based on the requirements of the CA/Browser Forum (version 1.4.1).

The full text is not reproduced here (copyright): see the official source.

Summary

Purpose

European standard ETSI EN 319 412-4 (version 1.4.1, June 2025) defines the profile of website certificates ETSI EN 319 412-4 V1.4.1, § 1 Scope ETSI EN 319 412-4 V1.4.1, History. Its scope begins as follows:

Official text · ETSI EN 319 412-4 V1.4.1, § 1 Scope

The present document specifies a certificate profile for web site certificates that are accessed by the TLS protocol

The profile builds on the Baseline Requirements and the EV Guidelines (extended validation) of the CA/Browser Forum; it concerns the content of certificates and applies to legal persons as well as natural persons ETSI EN 319 412-4 V1.4.1, § 1 Scope.

Who it applies to

To providers that issue website certificates, qualified or not, according to the certificate policy followed ETSI EN 319 412-4 V1.4.1, § 4.1 Generic profile requirements.
In particular to qualified trust service providers that issue qualified certificates for website authentication, through the intermediate standards of Implementing Regulation 2025/2527 List of reference standards for qualified certificates for website authentication.

Key points

One profile per policy: DVCP, IVCP or OVCP refer to the Baseline Requirements of the CA/Browser Forum; EVCP and QEVCP-w to its EV Guidelines; NCP and QNCP-w-gen to the profiles of ETSI EN 319 412-2 or 412-3, with certain fields of the Baseline Requirements; QNCP-w to the Baseline Requirements ETSI EN 319 412-4 V1.4.1, § 4.1.1 Certificates following DVCP, IVCP or OVCP ETSI EN 319 412-4 V1.4.1, § 4.1.2 Certificates following EVCP or QEVCP-w ETSI EN 319 412-4 V1.4.1, § 4.1.3 Certificates following NCP or QNCP-w-gen ETSI EN 319 412-4 V1.4.1, § 4.1.4 Certificates following QNCP-w.
EU qualified certificates: they contain the QCStatements of clauses 4 and 5 of ETSI EN 319 412-5 ETSI EN 319 412-4 V1.4.1, § 4.2 EU Qualified Certificate statements for EU Qualified Certificates ETSI EN 319 412-5 V2.5.1. They should carry one of the policy identifiers of ETSI EN 319 411-2, consistent with these statements ETSI EN 319 412-4 V1.4.1, § 4.3 Certificate policies for EU Qualified Certificates ETSI EN 319 411-2 V2.6.1.
Organisation identifier: for an EV qualified certificate, and for QNCP-w when the issuer or the subject is a legal person, the organizationIdentifier attribute is mandatory if an appropriate registration number exists ETSI EN 319 412-4 V1.4.1, § 4.1.2 Certificates following EVCP or QEVCP-w ETSI EN 319 412-4 V1.4.1, § 4.1.4 Certificates following QNCP-w.

What the acts apply, and how

Implementing Regulation 2025/2527 (qualified certificates for website authentication), applicable from 6 January 2027 Art. 2: the annex does not name EN 319 412-4; it refers to it through intermediate standards List of reference standards for qualified certificates for website authentication.
- For certificates other than those of point 1, including in a browser: ETSI TS 119 411-5 version 2.1.1. It requires the certificates of its two approaches (1-QWAC and 2-QWAC) to be issued in accordance with EN 319 412-4, cited without a version, with an exception for the extended key usage of the 2-QWAC ETSI TS 119 411-5 V2.1.1, § 4.1.2 Certificate Profile Requirements ETSI TS 119 411-5 V2.1.1, § 4.2.2 Certificate Profile Requirements ETSI TS 119 411-5 V2.1.1, § 2.1 Normative references.
- For certificates used for TLS outside a browser, the annex offers two options List of reference standards for qualified certificates for website authentication. The first is ETSI TS 119 495 version 1.7.1, which recommends (should) applying in that case the QNCP-w-gen profile of EN 319 412-4, cited without a version ETSI TS 119 495 V1.7.1, § 5.3 Profile Requirements for Certificate for TLS Authentication ETSI TS 119 495 V1.7.1, § 2.1 Normative references. The second is ETSI EN 319 411-2 version 2.6.1, the certificates then being issued under the QNCP-w-gen, QEVCP-w or QNCP-w policy of that standard. EN 319 411-2 does not cite EN 319 412-4; for the certificate profile, it makes applicable the requirements of clause 6.6.1 of ETSI EN 319 411-1, cited without a version ETSI EN 319 411-2 V2.6.1, § 6.6.1 Certificate Profile ETSI EN 319 411-2 V2.6.1, § 2.1 Normative references. In version 1.5.1 of EN 319 411-1, that clause designates EN 319 412-4 for website certificates issued under its own policies (OVCP, IVCP, DVCP, EVCP, LCP, NCP, NCP+), without naming the QEVCP-w, QNCP-w or QNCP-w-gen policies ETSI EN 319 411-1 V1.5.1, § 6.6.1 Certificate profile.
Regulation 910/2014 provides that the evaluation of compliance with the requirements of its Annex IV is carried out in accordance with these reference standards Art. 45(1).
Implementing Regulation 2025/2162: Annex II cites EN 319 412-4, without a version, for the issuance of qualified certificates for website authentication; conformity assessment schemes state the year and version number of the standards Annex II Art. 6(3).

Cited version

Implementing Regulation 2025/2527 names version 1.7.1 of ETSI TS 119 495 List of reference standards for qualified certificates for website authentication. The index of ETSI standards in the corpus, consulted on 31 October 2026, mentions a more recent published version, 1.8.1, whose text is not in the corpus.

Important clauses

ETSI EN 319 412-4 V1.4.1, § 1 Scope: scope.
ETSI EN 319 412-4 V1.4.1, § 4.1 Generic profile requirements: requirements by policy.
ETSI EN 319 412-4 V1.4.1, § 4.2 EU Qualified Certificate statements for EU Qualified Certificates: statements of qualified certificates.
ETSI EN 319 412-4 V1.4.1, § 4.3 Certificate policies for EU Qualified Certificates: policies of qualified certificates.

Links

Intermediate standards: ETSI TS 119 411-5 ETSI TS 119 411-5 V2.1.1, ETSI TS 119 495 ETSI TS 119 495 V1.7.1.
Other parts of the series: overview ETSI EN 319 412-1 V1.6.1, natural persons ETSI EN 319 412-2 V2.4.1, legal persons ETSI EN 319 412-3 V1.3.1, QCStatements ETSI EN 319 412-5 V2.5.1.
Learning path: step 4, trust services.

Consolidation without official value

This summary cites the consolidated version, published on EUR-Lex, of Regulation 910/2014 Regulation (EU) No 910/2014 — consolidated version of 18/10/2024. It serves as documentation: only the text published in the Official Journal is authentic.

ETSI standard: the site reproduces only short extracts; the full text is available from ETSI ETSI EN 319 412-4 V1.4.1. Written by Asphalia.