eIDAS QWACs website authentication certificates

eIDAS defines a certificate for website authentication as an electronic attestation that authenticates a website and links that website to the natural or legal person to whom the certificate is issued. A qualified certificate for website authentication is that certificate type when it is issued by a qualified trust service provider and meets Annex IV.

For product and security teams, the practical distinction is important: a TLS certificate may support encrypted website connections, but eIDAS qualification depends on legal status, issuer qualification, Annex IV certificate data, certificate policy evidence, and trusted-list status. ETSI EN 319 412-5 also states that the QCStatements extension is not processed as part of ordinary RFC 5280 path validation, so QWAC qualification needs checks beyond a basic certificate-chain result.

Annex IV is the first content checklist. A QWAC must identify itself, in at least an automated-processing form, as a qualified certificate for website authentication. It must also identify the qualified trust service provider, the subject, address elements, operated domain name or names, validity period, certificate identity code, issuer signature or seal, and certificate-status information.

This makes the evidence review concrete. The certificate should link the website to the person or legal person operating the domain, and the record should show the free location of the certificate supporting the issuer signature or seal plus the place where certificate validity status can be checked.

A certificate should not be treated as qualified only because its visible subject fields look plausible. ETSI TS 119 612 explains that trusted lists let interested parties determine whether a trust service is or was operating in compliance with relevant requirements, including the current status and status history of the service.

For QWACs, check the EU List of Trusted Lists route to the relevant Member State trusted list, the trust service provider entry, the service type and service status, and the service information extensions that indicate website authentication. ETSI TS 119 612 includes QCForWSA and For Web Site Authentication indicators for certificates or services issued for website authentication.

Article 45 says qualified certificates for website authentication issued in accordance with the Article 45 requirements must be recognised by providers of web browsers. It also says browser providers must display identity data and additional attested attributes in a user-friendly manner, with a limited exception for microenterprises or small enterprises during their first five years of operating as browser-service providers.

Do not turn that into a broader claim than the sources support. The grounded distinction is that browsers have eIDAS recognition and display obligations for qualifying QWACs, while certificate qualification itself still depends on the eIDAS and ETSI evidence: Annex IV content, QTSP issuance, QCStatement or certificate-type indicators, trusted-list status, and certificate policy or CPS support.

Use this checklist when accepting a QWAC from a supplier, configuring relying-party trust, reviewing a website authentication claim, or preparing evidence for compliance review. The aim is a reproducible validation record, not a general certificate inventory.

A strong QWAC record shows the certificate was qualified for website authentication at the relevant time, the issuing service was granted or otherwise qualified in the trusted-list evidence used, and the certificate content matches the website and legal person facts relied on by the business.