Qualified website authentication certificates are eIDAS trust-service certificates that authenticate a website and link it to the natural or legal person that operates the domain.
This page helps check Annex IV certificate content, QTSP qualification, trusted-list status, browser-recognition obligations, and validation evidence without treating an ordinary TLS certificate as automatically qualified.
Structured answer sets in this page tree.
Cited legal and guidance references.
A is a qualified certificate for website authentication under eIDAS. To establish that status, confirm that a qualified trust service provider issued the certificate, the certificate meets the Annex IV data requirements, and the issuing service had the required status in the EU trusted-list evidence. Certificate-policy and QCStatement evidence support that review. A TLS certificate or successful handshake alone does not establish qualification.
eIDAS defines a certificate for website authentication as an electronic attestation that authenticates a website and links that website to the natural or legal person to whom the certificate is issued. A qualified certificate for website authentication is that certificate type when it is issued by a qualified trust service provider and meets Annex IV.
A TLS certificate may support encrypted website connections, but eIDAS qualification depends on legal status, QTSP issuance, Annex IV certificate data, and trusted-list status. Certificate-policy evidence supports the review. ETSI EN 319 412-5 also states that the extension is not processed as part of ordinary RFC 5280 path validation, so a basic certificate-chain result cannot establish qualification.
Annex IV is the first content checklist. A must identify itself, in at least an automated-processing form, as a qualified certificate for website authentication. It must also identify the qualified trust service provider, the subject, address elements, operated domain name or names, validity period, certificate identity code, issuer signature or seal, and certificate-status information.
The certificate links the website to the certificate subject, but that link does not prove ownership of every statement or transaction made through the site. The review record should show the free location of the certificate supporting the issuer signature or seal and the place where certificate validity status can be checked.
A certificate should not be treated as qualified only because its visible subject fields look plausible. ETSI TS 119 612 explains that let interested parties determine whether a trust service is or was operating in compliance with relevant requirements, including the current status and status history of the service.
For QWACs, check the EU List of route to the relevant Member State trusted list, the trust service provider entry, the service type and service status, and the service information extensions that indicate website authentication. ETSI TS 119 612 includes QCForWSA and For Web Site Authentication indicators for certificates or services issued for website authentication.
Article 45 says qualified certificates for website authentication issued in accordance with Article 45(1) must be recognised by web-browser providers. Those providers must display the identity data and additional attested attributes in a user-friendly manner and support and interoperate with the certificates. The support and interoperability duty has a limited exception for microenterprises or small enterprises during their first five years of operating as web-browser service providers.
Browser recognition does not establish the certificate's qualified status and does not guarantee that every browser presents identity information in the same interface. Qualification still depends on Annex IV content, QTSP issuance, the applicable Article 45 requirements, and trusted-list evidence; and CP/CPS material help automated and policy review but do not replace the legal status check.
Article 45a permits a browser provider to take precautionary measures against an identified certificate or certificate set only when it has substantiated concerns about a security breach or loss of integrity. The browser provider must notify the Commission, supervisory body, certificate subject, and issuing QTSP without undue delay. If the supervisory investigation does not withdraw qualified status, the authority must ask the browser provider to end the measures.
This checklist is relevant when accepting a from a supplier, configuring relying-party trust, reviewing a website authentication claim, or preparing evidence for compliance review. The aim is a reproducible validation record, not a general certificate inventory.
A record should show that the certificate was qualified for website authentication at the relevant time, the issuing service had granted qualified status in the trusted-list evidence used, and the certificate content matches the domain and subject identity facts relied on by the business.
No. A is a qualified certificate for website authentication issued by a qualified trust service provider and meeting Annex IV. Ordinary TLS certificate validation does not by itself prove eIDAS qualified status.
Start with the certificate's website-authentication purpose, the issuing QTSP, Annex IV data fields, and trusted-list status for the relevant date. Then review certificate policy, CPS, QCStatement, and status-service evidence.
Sorena can help map certificate content, trusted-list evidence, CP/CPS material, and validation results into a repeatable QWAC review workflow.
Ask questions tied to cited sources about QWAC definitions, trusted lists, certificate profiles, and validation evidence using the cited sources on this page.
Review your QWAC acceptance criteria, evidence gaps, and supplier certificate checks with Sorena.
"Certification Practice Statement"
"id-etsi-qct-web"
"For Web Site Authentication"
"meets the requirements laid down in Annex IV"