Electronic Signatures and Trust Infrastructures (ESI); Policy and security requirements for Trust Service Providers issuing certificates; Part 8: Access Certificate Policy for EUDI Wallet Relying Parties

Note

ETSI technical specification, part 8, setting the requirements for access certificates (qualified or not) of wallet-relying parties, with regard to Implementing Regulation 2025/848 (version 1.1.1).

Summary

Purpose

Technical specification ETSI TS 119 411-8 (version 1.1.1, October 2025) sets the requirements applicable to wallet-relying party access certificates ETSI TS 119 411-8 V1.1.1, § 1 Scope ETSI TS 119 411-8 V1.1.1, History. A wallet-relying party is a relying party that intends to rely upon wallet units to provide its services Art. 2(1). Its scope begins as follows:

The access certificate is used to authenticate the relying party to the wallet and to establish its trustworthiness; it is issued by a designated provider, under the supervision of a Member State ETSI TS 119 411-8 V1.1.1, Introduction. The specification targets in particular Implementing Regulation 2025/848 and imposes nothing on the competent authorities that register relying parties ETSI TS 119 411-8 V1.1.1, § 1 Scope.

Who it applies to

• Providers of wallet-relying party access certificates, that is, the persons mandated by a Member State to issue these certificates to the relying parties registered in that State Art. 2(11).
• Member States, which establish certificate policies and certificate practice statements specific to these certificates, in accordance with Annex IV to Implementing Regulation 2025/848 Art. 7(3).

Key points

• Four certificate policies: two normalised policies (NCP) and two qualified policies (QCP), each for natural persons or for legal persons, with their object identifiers (OID) ETSI TS 119 411-8 V1.1.1, § 5.3 Certificate Policy name and identification. Certificates issued under the QCP-n-eudiwrp policy (natural persons) target advanced electronic signatures based on a qualified certificate; the QCP-l-eudiwrp policy (legal persons) covers qualified certificates for seals, for advanced electronic seals based on a qualified certificate ETSI TS 119 411-8 V1.1.1, § 5.5.3 QCP-n-eudiwrp ETSI TS 119 411-8 V1.1.1, § 5.5.4 QCP-l-eudiwrp.
• Built on EN 319 411-1: most clauses refer to ETSI EN 319 411-1, and the qualified policies add the requirements of ETSI EN 319 411-2 ETSI TS 119 411-8 V1.1.1, § 4.1 General policy requirements concept ETSI TS 119 411-8 V1.1.1, § 6.2.2 Initial Identity Validation. Both standards are cited without a version; for an undated reference, the specification refers to the latest version ETSI TS 119 411-8 V1.1.1, § 2.1 Normative references.
• Link with the register: before issuing a certificate, the provider checks that the relying party appears, with a valid registration status, in the national register of the Member State where it is established ETSI TS 119 411-8 V1.1.1, § 6.2.2 Initial Identity Validation.
• Revocation: the provider continuously monitors changes in the national register; it revokes any access certificate when the registration of the relying party is suspended or cancelled ETSI TS 119 411-8 V1.1.1, § 6.3.9 Certificate Revocation and Suspension.
• Certificate profile: for a legal person, the organizationIdentifier field is mandatory, and the certificate gives at least one means of contacting the relying party ETSI TS 119 411-8 V1.1.1, § 6.6.1 Certificate Profile.

What the implementing act applies, and how

Implementing Regulation 2025/848 concerns the registration of wallet-relying parties Art. 1. It applies from 24 December 2026 Art. 11. Point 3 of its Annex IV provides that the certificate policy and certificate practice statement of access certificates are harmonised across the Union, comply, as applicable, with TS 119 411-8, and include a list of elements Annex IV. This wording comes from Implementing Regulation 2026/1730, which replaced, in the first paragraph of point 3, the text:

with the following text Annex II:

• Clauses: the annex targets the whole specification, without a list of clauses, without adaptation and without a choice among the four policies Annex IV.
• Regime: this is a compliance requirement, qualified by the words as applicable. The article of Regulation 910/2014 that empowers the Commission provides for no presumption of conformity Art. 5b(11) amending Implementing Regulation (EU) 2025/848 as regards applicable standards and specifications.
• Overlaps: Annex IV itself requires the provider to check the registration upon issuance, to monitor the register and to revoke if the registration is suspended or cancelled Annex IV, which the specification turns into requirements.

Important clauses

• ETSI TS 119 411-8 V1.1.1, § 1 Scope: scope.
• ETSI TS 119 411-8 V1.1.1, § 5.3 Certificate Policy name and identification: policies and identifiers.
• ETSI TS 119 411-8 V1.1.1, § 6.2.2 Initial Identity Validation: verification of identity and registration.
• ETSI TS 119 411-8 V1.1.1, § 6.3.9 Certificate Revocation and Suspension: revocation.
• ETSI TS 119 411-8 V1.1.1, § 6.6.1 Certificate Profile: certificate profile.

Links

• Base standards: ETSI EN 319 411-1 ETSI EN 319 411-1 V1.5.1 and ETSI EN 319 411-2 ETSI EN 319 411-2 V2.6.1. The former text of Annex IV targeted version 1.4.1 of EN 319 411-1 ETSI EN 319 411-1 V1.4.1; the latest published version, 1.5.1, is also in the corpus ETSI EN 319 411-1 V1.5.1.
• Wallet-relying party registration certificates: ETSI TS 119 475, which the specification cites among its normative references ETSI TS 119 475 V1.2.1 ETSI TS 119 411-8 V1.1.1, § 2.1 Normative references.
• Learning path: step 7, the relying party.

ETSI standard: the site reproduces only short extracts; the full text is available from ETSI ETSI TS 119 411-8 V1.1.1. Written by Asphalia.