eIDAS certificates and authentication

Start with the transaction, not the certificate file. eIDAS covers notified electronic identification schemes, European Digital Identity Wallets provided by Member States, and trust service providers established in the Union. It also sets the legal framework for electronic signatures, seals, timestamps, registered delivery, website authentication certificates, attestations of attributes, archiving, and ledgers.

A certificate is qualified only when the eIDAS conditions for that certificate type are met. For signature and seal certificates, check that the certificate is issued by a qualified trust service provider and contains the required qualified-certificate information. For website authentication, a qualified certificate for website authentication is issued by a qualified trust service provider and must meet Annex IV requirements.

Do not treat a logo, a supplier statement, or a browser trust-store result as the complete eIDAS check. eIDAS requires Member States to maintain trusted lists for qualified trust service providers and the qualified trust services they provide. Trusted-list status is the public evidence that a provider and a specific service have qualified status.

A relying party check should therefore bind the certificate to the issuer, the trust service, the service status, and the time of the transaction. ETSI trusted-list guidance describes using trusted-list information in certificate path validation, including validating the trusted-list source, selecting CA entries under the applicable trust policy, holding selected CA certificates as trust anchors, and regularly checking for status changes.

For qualified electronic signatures and advanced electronic signatures based on qualified certificates, eIDAS validation is a result that must be explainable to the relying party. The validation process must confirm the certificate's qualified nature at the time of signing, that it was issued by a qualified trust service provider, that it was valid at that time, that the validation data matches what was provided to the relying party, and that the signed data integrity was not compromised.

The validation evidence should be kept as a transaction record. It should show the signed object, signing time used by the validator, certificate chain, trusted-list status, revocation or validity status response, validation policy, result, warnings, and the version of the validation tool or service used.

A qualified certificate for website authentication is not just an ordinary TLS certificate with stronger branding. eIDAS defines it as a website authentication certificate issued by a qualified trust service provider that meets Annex IV. Article 45 requires providers of web-browsers to recognise qualified certificates for website authentication issued in accordance with those requirements and to display the identity data attested in the certificate and additional attested attributes in a user-friendly manner.

The practical check is whether the certificate contains the Annex IV data needed to authenticate the website and bind it to the natural or legal person to whom it was issued. That includes the qualified-certificate indication, issuer data, subject identity data, address elements, domain names, validity period, certificate identity code, issuer signature or seal, issuer certificate location, and certificate validity status service information.

Qualified trust service providers issuing qualified certificates must register revocations, publish revocation status in a timely manner, and make validity or revocation status available to relying parties on a per-certificate basis in an automated, reliable, free-of-charge, and efficient manner. A relying party record should therefore include the exact status evidence used, not just a pass or fail label.

If a browser provider takes precautionary measures against a QWAC because of substantiated security-breach or integrity concerns, eIDAS requires notification to the Commission, the competent supervisory body, the certificate subject, and the issuing qualified trust service provider. For relying-party operations, that means incident evidence should link certificate status, supervisory-body outcome, and any browser-specific treatment.