Electronic Signatures and Trust Infrastructures (ESI); Policy and security requirements for Trust Service Providers issuing certificates; Part 5: Implementation of qualified certificates for website authentication as in amended Regulation 910/2014

Note

ETSI technical specification, part 5, defining two approaches (1-QWAC and 2-QWAC) for issuing qualified website authentication certificates and deploying them on websites (version 2.1.1).

Summary

Purpose

Technical specification ETSI TS 119 411-5 (version 2.1.1, February 2025) organises the issuance of qualified certificates for website authentication (QWACs), their deployment to websites and their consumption by web browsers ETSI TS 119 411-5 V2.1.1, § 1 Scope ETSI TS 119 411-5 V2.1.1, History. Its scope begins as follows:

According to the specification, both approaches aim to meet the requirements of Regulation 2024/1183 relating to these certificates ETSI TS 119 411-5 V2.1.1, § 1 Scope. Version 1.1.1 of January 2023 was a technical report (TR) ETSI TS 119 411-5 V2.1.1, History.

Who it applies to

The specification addresses three actors, with one clause for each ETSI TS 119 411-5 V2.1.1, § 1 Scope:

• the qualified trust service providers that issue the certificates (clause 4);
• the website operators that use them (clause 5, guidance);
• the web browsers that consume them (clause 6).

Key points

• Approach 1 (1-QWAC): the qualified certificate is used directly to establish the TLS connection between the browser and the server; it is issued under the QEVCP-w or QNCP-w policy of ETSI EN 319 411-2 and the profile of ETSI EN 319 412-4 ETSI TS 119 411-5 V2.1.1, § 1 Scope ETSI TS 119 411-5 V2.1.1, § 4.1 1-QWAC Approach.
• Approach 2 (2-QWAC): the qualified certificate, issued under the QNCP-w-gen policy, is used only to sign a binding to the TLS certificates of the website, which are themselves recognised by the browsers’ root stores; its extended key usage is limited to id-kp-tls-binding ETSI TS 119 411-5 V2.1.1, § 1 Scope ETSI TS 119 411-5 V2.1.1, § 4.2 2-QWAC Approach.
• TLS binding: the website operator signs, with the key of the 2-QWAC, a JAdES signature over the list of its TLS certificates, and signals it with an HTTP Link header ETSI TS 119 411-5 V2.1.1, § 5.2 Usage of 2-QWACs ETSI TS 119 411-5 V2.1.1, Annex B (normative): TLS Certificate Binding Profile.
• Browser checks: QCStatements and policy, chain up to an issuer in the EU trusted list authorised to issue QWACs, validity, domain name, profile ETSI TS 119 411-5 V2.1.1, § 6.1.2 Validation of QWACs.
• Display: on success, the browser indicates that the certificate is qualified, with the EU trust mark where technically possible, and displays the identity data in a user-friendly manner; on failure, it displays no qualified status indicator ETSI TS 119 411-5 V2.1.1, § 6.3 Validation outcomes.

What the acts apply, and how

• Implementing Regulation 2025/2527: for qualified certificates for website authentication other than those used in TLS outside a browser, including in a browser, the annex refers to TS 119 411-5 version 2.1.1, as a whole and without adaptation List of reference standards for qualified certificates for website authentication. The Regulation applies from 6 January 2027 Art. 2. It designates these standards as the reference standards for the certificates Art. 1 Art. 45(2). Here Regulation 910/2014 provides not for a presumption, but for an evaluation carried out in accordance with these standards:

The obligations of providers of web-browsers come from Regulation 910/2014 itself: recognise the certificates issued in accordance with paragraph 1, ensure the user-friendly display of the identity data and of the additional attested attributes, and ensure support and interoperability with these certificates, except, for this last obligation, micro or small enterprises during their first five years of activity as providers of web-browsing services Art. 45(1a). The Regulation adds that these certificates are not subject to any mandatory requirements other than those of paragraph 1 Art. 45(1b). A recital asks that the reference standards allow for standalone certificates, certificates linked to other certificates, or other configurations, without prejudice to the freedom of providers of web-browsers as regards web security laying down rules for the application of Regulation (EU) No 910/2014 of the European Parliament and of the Council as regards reference standards for qualified certificates for website authentication.

• Implementing Regulation 2025/2162: Annex II cites TS 119 411-5, without a version, for the issuance of qualified certificates for website authentication; conformity assessment schemes indicate the year and version number of the standards Annex II Art. 6(3).

Important clauses

• ETSI TS 119 411-5 V2.1.1, § 1 Scope: scope and objectives of both approaches.
• ETSI TS 119 411-5 V2.1.1, § 4 Trust Service Provider Requirements for issuing Qualified Certificates for Website Authentication: requirements for providers.
• ETSI TS 119 411-5 V2.1.1, § 6 Web Browser Requirements for consuming Qualified Certificates for Website Authentication: requirements for browsers.
• ETSI TS 119 411-5 V2.1.1, Annex B (normative): TLS Certificate Binding Profile: profile of the TLS binding.

Links

• Standards it refers to: ETSI EN 319 411-2 ETSI EN 319 411-2 V2.6.1, ETSI EN 319 412-4 ETSI EN 319 412-4 V1.4.1, JAdES ETSI TS 119 182-1 V1.2.1, ETSI TS 119 615 ETSI TS 119 615 V1.4.1.
• Options in the annex to 2025/2527 for TLS outside a browser: ETSI EN 319 411-2 (policies QNCP-w-gen, QEVCP-w or QNCP-w) ETSI EN 319 411-2 V2.6.1 or ETSI TS 119 495 ETSI TS 119 495 V1.7.1.
• Learning path: step 4, trust services.

ETSI standard: the site reproduces only short extracts; the full text is available from ETSI ETSI TS 119 411-5 V2.1.1. Written by Asphalia.