ETSI EN 319 411-1
Understand ETSI EN 319 411-1 V1.5.1 requirements for certificate-issuing trust service providers, including policy profiles, / duties, identity validation, lifecycle controls, revocation, keys, and records.
ETSI EN 319 411-1 V1.5.1 is the European standard for generally applicable policy and security requirements for trust service providers (TSPs) issuing public-key certificates, including trusted website certificates. It covers policy documentation, registration, issuance, revocation, status services, keys, and retained evidence.
Choose the policy profile and service boundary first. NCP+ and EVCP build on NCP; DVCP, OVCP, and IVCP build on LCP; and the web-certificate profiles also depend on the applicable live /Browser Forum requirements. V1.5.1 cites ETSI EN 319 401 without a version, so its clause 2.1 rule for non-specific references makes the latest EN 319 401 edition applicable; record the editions and assessment date used. The retains overall responsibility even when a CA component, registration authority (), or another provider performs part of the service.
Clause-oriented overview for certificate-issuing trust service providers.
Planning structure for policy identifiers, PKI participants, certificate usage, and disclosure material.
Operational path from certificate application through issuance, and status services, revocation, and archival records.
Select LCP, NCP, NCP+, DVCP, OVCP, IVCP, EVCP, or a clause 7 policy, then map unmarked, conditional, choice-based, profile-marked, and web requirements.
Separate the Certificate Policy rules from the Certification Practice Statement that describes how the issues, manages, revokes, renews, and re-keys certificates.
Trace certificate application, processing, issuance, acceptance, usage, renewal, re-key, modification, revocation, suspension, and status-service obligations.
New to the standard? Establish the policy profile, service boundary, and participant roles first. If scope is already documented, jump to registration, lifecycle operations, evidence, or a focused comparison.
Select the certificate policy and its inherited requirements, distinguish the responsible from and delegated functions, identify subscribers, subjects, and relying parties, and connect policy commitments to operating practices.
Map who validates subscriber and subject information, how authority and proof of possession are checked, what an may perform, and which records the responsible retains.
Trace applications through issuance, acceptance, renewal, re-key, modification, revocation or suspension, status information, and protected -key operation, including the standard's short-term and validity-assured certificate branches.
Build a traceable assessment file while keeping internal evidence preparation separate from independent conformity assessment, legal compliance, qualified status, and browser root-program acceptance.
Separate Part 1 from the qualified-certificate requirements in Part 2, identify live /Browser Forum dependencies for publicly trusted TLS certificates, or open the FAQ for a specific operational question.
"ETSI EN 319 411-1 V1.5.1 (2025-04)"
Next steps
Prepare / review, subscriber registration evidence, certificate lifecycle controls, and operating controls, revocation status services, and the audit file.
Turn ETSI EN 319 411-1 topics into owned assessment tasks for /, registration, lifecycle, revocation, and archival evidence.
Research / scope, certificate policy choices, delegation, revocation status services, and related ETSI standards with cited outputs.
Review certificate issuance scope, policy documentation, registration evidence, and responsibilities, and audit-file gaps.