eIDAS QES Validation

Article 32 of Regulation (EU) No 910/2014 sets the validation requirements for qualified electronic signatures. A relying party should treat the validation output as a legal and technical conclusion, not as a simple cryptographic pass/fail.

The check should be anchored at the time of signing. A certificate can be revoked later, but QES validation still needs evidence about whether the certificate was qualified, issued by a QTSP, and valid at the relevant signing time.

The trusted-list check is the control that prevents a relying party from accepting a certificate as qualified only because a vendor label says it is. ETSI explains that EU Member State trusted lists include qualified trust service providers and their qualified trust services, and that the Commission publishes a central List Of Trusted Lists for access to Member State lists.

For QES validation, retain the trusted-list status used by the validator: the Member State list or LOTL source, the service type, the service status and history, the qualified certificate status, and the time at which the trust-list evidence was evaluated.

Certificate validation should capture both current cryptographic checks and signing-time context. eIDAS requires the certificate to have been qualified, QTSP-issued, and valid at signing time; the certificate also needs usable validity or revocation status information.

A validation report can show a current revocation while still reaching a qualified-signature conclusion if the signature contains reliable time evidence and the revocation happened after the best signature time. That conclusion depends on the selected validation process and the retained timestamp, revocation, and trust-list evidence.

DSS is useful grounding for implementation because its reports make the validation decision inspectable. The detailed report separates validation processes from building blocks, so a relying party can see whether a failure came from the signature, a timestamp, revocation data, certificate validation, or trusted-list interpretation.

For QES acceptance, do not retain only a green banner or a PDF viewer screenshot. Retain the diagnostic data, detailed report, validation policy or constraints, trusted-list source, certificate path, revocation responses, timestamp evidence, and the final indication that the signature was qualified.

The retained evidence should let a later reviewer reproduce why the signature was accepted as qualified. The key question is not only whether the document was signed, but whether the validation result proves the eIDAS conditions at the relevant time.

If the business depends on the signature's qualified status, store validation evidence with the transaction record, not only inside a temporary signing platform. Re-run validation when the signed object, detached contents, trust-list configuration, validation policy, or certificate status evidence changes.