Electronic Signatures and Trust Infrastructures (ESI); Relying party attributes supporting EUDI Wallet user's authorization decisions

Note

ETSI technical specification setting the requirements for certificate-based attestations used to identify and authorise EUDI wallet relying parties, including registration certificates (version 1.2.1).

Summary

Purpose

Technical specification ETSI TS 119 475 (version 1.2.1, March 2026) concerns the certificates that identify wallet-relying parties and describe what they are authorised to request ETSI TS 119 475 V1.2.1, § 1 Scope ETSI TS 119 475 V1.2.1, History. Its scope begins as follows:

Above all, it defines the policy and profile of the registration certificates of relying parties (WRPRC), the mapping of data between this certificate and the access certificate (WRPAC), and recommendations for coordination between their providers ETSI TS 119 475 V1.2.1, § 1 Scope. It sets no requirements on the design or internal operation of the wallet ETSI TS 119 475 V1.2.1, § 1 Scope.

Who it applies to

• Member States, which authorise at least one certificate authority to issue registration certificates, and implement dedicated certificate policies and practice statements for these certificates, in accordance with Annex V to Implementing Regulation 2025/848 Art. 8(1) Art. 8(2)(f).
• Providers of wallet-relying party registration certificates: Member States ensure that they issue these certificates in an automated manner and without undue delay after the registration, and require them to issue them exclusively to registered relying parties Art. 8(1) Art. 8(2)(a).
• Wallet providers, for the use of the access certificate in presentation requests (see below) Art. 5(1).

Key points

• Two complementary certificates: the access certificate authenticates the relying party to the wallet; the registration certificate indicates the declared intended uses and the data it may request. Both are linked by the identifier of the relying party ETSI TS 119 475 V1.2.1, § 4.5 Registration and access certificate relation.
• Access certificate: the specification does not set the policy of this certificate, which it refers to TS 119 411-8; it gives its data mapping ETSI TS 119 475 V1.2.1, § 4.3 Wallet-Relying Party Access Certificates (WRPACs).
• Registration certificate: it serves transparency towards the user and data minimisation; in the absence of a certificate, the wallet consults the national register ETSI TS 119 475 V1.2.1, § 4.4 Wallet-Relying Party Registration Certificates (WRPRCs). This clause presents the issuance of registration certificates as an option open to Member States (may mandate or allow); in its version amended by Implementing Regulation 2026/1730, the article governing these certificates provides that Member States authorise at least one certificate authority to issue them Art. 8(1).
• Format: a JWT or CWT token signed by the provider; the JWT carries a JAdES signature of level B-B ETSI TS 119 475 V1.2.1, § 5.2.1 Format.
• Policy and entitlements: a policy identifier of its own (OID) and a list of role identifiers, from service provider to PID or attestation provider ETSI TS 119 475 V1.2.1, § 6.1.3 Certificate Policy name and identification ETSI TS 119 475 V1.2.1, A.2 WRP entitlement identifiers.

What the acts apply, and how

• Implementing Regulation 2025/848, Annex V, point 3 (Regulation applicable from 24 December 2026 Art. 11): the certificate policy and certificate practice statement of registration certificates are harmonised across the Union, comply with TS 119 475 version 1.2.1 and include a list of elements Annex V. Implementing Regulation 2026/1730 replaced, in the first paragraph of point 3, a requirement to comply with the normalised policy of ETSI EN 319 411-1 version 1.4.1 with the following text Annex III:

Unlike the access certificate, for which Annex IV says as applicable, this wording contains no qualification Annex IV. The annex targets the whole specification, without a list of clauses or adaptation. The article of Regulation 910/2014 that empowers the Commission provides for no presumption of conformity Art. 5b(11).

• Implementing Regulation 2024/2982, Annex II: requirement OIDFVP-HAIP-COMMON-REQ-RO-23 specifies that the end-entity certificate used with the x509_hash prefix of OpenID4VP is an access certificate as specified in TS 119 475 Annex II. This reference passes through the intermediate standard ETSI TS 119 472-2, whose reference [14] cites TS 119 475 without a version ETSI TS 119 472-2 V1.2.1, § 2.1 Normative references.

Important clauses

• ETSI TS 119 475 V1.2.1, § 1 Scope: scope.
• ETSI TS 119 475 V1.2.1, § 4 General concepts: roles and certificates.
• ETSI TS 119 475 V1.2.1, § 5.2 WRPRC profile requirements: profile of the registration certificate.
• ETSI TS 119 475 V1.2.1, § 6 Policy requirements for WRPRC: policy of the registration certificate.
• ETSI TS 119 475 V1.2.1, Annex A (normative): WRP identifiers: identifiers.

Links

• Earlier version in the corpus: ETSI TS 119 475 V1.1.1 ETSI TS 119 475 V1.1.1.
• Access certificates: ETSI TS 119 411-8 ETSI TS 119 411-8 V1.1.1.
• Learning path: step 7, the relying party.

ETSI standard: the site reproduces only short extracts; the full text is available from ETSI ETSI TS 119 475 V1.2.1. Written by Asphalia.