ETSI EN 319 411-1 vs CA/B Forum Baseline Requirements
Use this crosswalk to decide which CA/Browser Forum requirements apply to an EN 319 411-1 V1.5.1 certificate policy.
Selected [WEB] controls generally refer to BR V1.8.6, but the domain and IP validation requirement cites the undated BR reference. DVCP, OVCP, and IVCP require the full latest TLS .
ETSI EN 319 411-1 V1.5.1 does not replace the CA/Browser Forum for publicly trusted TLS server certificates. Apply the ETSI CP/CPS and certificate-service controls first. Then use one of two BR paths: a policy that adopts [WEB]-tagged controls follows the selected BR references cited by ETSI, including the undated domain/IP validation reference, while a CA asserting the ETSI DVCP, OVCP, or IVCP policy OID must also follow the full latest BR for the corresponding DV, OV, or IV policy. Check the live official BR text and its effective dates before deciding which version applies.
Side-by-side comparison
ETSI EN 319 411-1 vs CA/B Forum BR: where the work splits
Separate the ETSI baseline, the selected BR references used by [WEB] controls, and the full latest BR required for DVCP, OVCP, or IVCP.
Defines general policy and security requirements for TSPs issuing public key certificates, including CP/CPS expectations, service components, publication, registration, revocation, and ETSI certificate-policy profiles.
Second framework
CA/B Forum BRG dependency
Has two ETSI entry points: selected BR clauses for [WEB] controls, including undated domain/IP validation references, and the full latest BR for DVCP, OVCP, or IVCP policy profiles.
ETSI EN 319 411-1 vs CA/B Forum BR: where the work splits
EN 319 411-1 covers TSPs issuing public key certificates, including trusted web site certificates, and supports reference policies such as LCP, NCP, NCP+, DVCP, OVCP, IVCP, and EVCP.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, [WEB] requirement tagging, CPS disclosure, domain/IP validation references, revocation-status expectations, and conflict rule for BRG-referenced certificate policies.
The present document includes provisions consistent with the requirements from the CA/Browser Forum in EVCG [4] and BRG [6].
A policy adopting [WEB]-tagged controls follows selected BR references; domain and IP validation cites undated BRG [6], while other controls cite fixed V1.8.6 [5]. A CA asserting DVCP, OVCP, or IVCP follows the full latest BR for the corresponding publicly trusted TLS certificate policy.
Current official BR text and version for the independent review required by the DVCP, OVCP, and IVCP bridge.
Name the certificate policy and OID first. That determines whether the ETSI bridge is limited to selected [WEB] controls or extends to the full latest BR.
EN 319 411-1 applies to TSPs issuing public key certificates and covers the CA, registration, dissemination, revocation management, revocation status, and optional subject-device functions within their certificate services.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
The BRG dependency arises for TSPs asserting DVCP, OVCP, or IVCP policy OIDs for publicly trusted TLS/SSL certificates, where root programs, browser vendors, and relying parties depend on CA/Browser Forum requirements being satisfied.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
Map actors by their certificate-service role under EN 319 411-1 and by their CA, delegated-party, application-software-supplier, or relying-party role under the BR.
An EN 319 411-1 review is triggered when a certification authority asserts an ETSI NCP, LCP, NCP+, DVCP, OVCP, IVCP, or EVCP certificate policy OID, or when a CP/CPS review or audit is required for any of those policy profiles.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
A full current BR review is required by the ETSI policy definition when a CA asserts DVCP, OVCP, or IVCP. A policy using [WEB]-tagged controls follows each stated reference, including the undated domain/IP reference, without automatically adopting the full latest BR.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
Record the exact policy profile and whether the dependency arises from a [WEB] tag, a DVCP/OVCP/IVCP OID, or a separate relying-party or contractual rule.
EN 319 411-1 requires a CP stating what must be adhered to and a CPS explaining how the TSP implements those requirements. Selected obligations are tagged [WEB] to mark controls that apply specifically to web-authentication certificates; DVCP, OVCP, and IVCP profiles add BRG-linked CPS duties.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
[WEB] controls incorporate selected BR requirements; verify whether each control cites fixed V1.8.6 [5] or undated BRG [6]. Domain and IP validation cites [6]. DVCP, OVCP, and IVCP add full-current-BR monitoring and the conflict rule that the latest BR prevails unless ETSI is more stringent.
EN 319 411-1 requires the TSP to verify subscriber and subject identity, check requests for accuracy, authorization, and completeness, and collect or validate direct evidence or attestation from appropriate sources.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
For domain and IP information, REG-6.2.2-03A [WEB] cites clauses 3.2.2.4 through 3.2.2.9 of undated BRG [6]. Check the latest edition, its effective dates, and the referenced methods. DVCP, OVCP, and IVCP additionally require the full latest BR.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
Record the validation method, ETSI requirement, exact BR reference and clause, edition, effective date, and evidence. Domain and IP validation uses the undated reference even outside the full-BR policy route.
EN 319 411-1 requires public CPS disclosure, availability of terms and conditions to relying parties, public international availability of those terms for publicly trusted certificates, support for OCSP or CRL, and public international availability of revocation status information.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
The current BR has its own effective dates and lifecycle deadlines. Those requirements must be read from the live BR for DVCP, OVCP, and IVCP rather than inferred from ETSI notes or older clause references.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
Track ETSI availability duties and current BR deadlines as separate cited controls; apply the stricter rule where the ETSI conflict clause requires it.
EN 319 411-1 V1.5.1 sets the ETSI baseline and permits confidential CPS sections. ETSI TC ESI is the relevant body for EN 319 411-1 revisions; conflicts with CA/B Forum SSL/TLS certificate policies should be reported to both ETSI TC ESI and the CA/Browser Forum.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
For OVCP, DVCP, and IVCP, BRG takes precedence when EN 319 411-1 conflicts with the latest BRG version, unless EN 319 411-1 is more stringent. The TSP must monitor BRG revisions and ensure compliance as requirements become effective, making BRG monitoring a live, repeating obligation.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
When BRG conflicts with EN 319 411-1 for DVCP, OVCP, or IVCP, BRG takes precedence unless the ETSI requirement is more stringent; retain the conflict and stringency analysis.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
The BR can address the same operations for publicly trusted TLS certificates, but the actors, conditions, deadlines, and evidence details must be compared requirement by requirement.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
A shared artifact may support both sources, but do not label a control jointly satisfied until the applicable ETSI and current BR requirements have been compared and the service boundary matches.
ETSI evidence should be organized by policy profile and service component: CP/CPS, subscriber and subject registration, certificate generation, dissemination, revocation management, revocation status, and supporting procedures.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
Map each [WEB] control to its stated BR reference, preserving the undated domain/IP dependency. Keep the full-current-BR mapping for DVCP, OVCP, or IVCP and separate root-program or application-software supplier rules.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
Do not infer public trust from an ETSI assessment. Public trust depends on the root being distributed by application software and on the applicable relying-party program requirements.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
Scope and certificate types
ETSI EN 319 411-1
EN 319 411-1 covers TSPs issuing public key certificates, including trusted web site certificates, and supports reference policies such as LCP, NCP, NCP+, DVCP, OVCP, IVCP, and EVCP.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, [WEB] requirement tagging, CPS disclosure, domain/IP validation references, revocation-status expectations, and conflict rule for BRG-referenced certificate policies.
The present document includes provisions consistent with the requirements from the CA/Browser Forum in EVCG [4] and BRG [6].
CA/B Forum BRG dependency
A policy adopting [WEB]-tagged controls follows selected BR references; domain and IP validation cites undated BRG [6], while other controls cite fixed V1.8.6 [5]. A CA asserting DVCP, OVCP, or IVCP follows the full latest BR for the corresponding publicly trusted TLS certificate policy.
Current official BR text and version for the independent review required by the DVCP, OVCP, and IVCP bridge.
Operational implication
Name the certificate policy and OID first. That determines whether the ETSI bridge is limited to selected [WEB] controls or extends to the full latest BR.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, [WEB] requirement tagging, CPS disclosure, domain/IP validation references, revocation-status expectations, and conflict rule for BRG-referenced certificate policies.
The present document includes provisions consistent with the requirements from the CA/Browser Forum in EVCG [4] and BRG [6].
Covered actors
ETSI EN 319 411-1
EN 319 411-1 applies to TSPs issuing public key certificates and covers the CA, registration, dissemination, revocation management, revocation status, and optional subject-device functions within their certificate services.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
CA/B Forum BRG dependency
The BRG dependency arises for TSPs asserting DVCP, OVCP, or IVCP policy OIDs for publicly trusted TLS/SSL certificates, where root programs, browser vendors, and relying parties depend on CA/Browser Forum requirements being satisfied.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
Operational implication
Map actors by their certificate-service role under EN 319 411-1 and by their CA, delegated-party, application-software-supplier, or relying-party role under the BR.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
Trigger
ETSI EN 319 411-1
An EN 319 411-1 review is triggered when a certification authority asserts an ETSI NCP, LCP, NCP+, DVCP, OVCP, IVCP, or EVCP certificate policy OID, or when a CP/CPS review or audit is required for any of those policy profiles.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
CA/B Forum BRG dependency
A full current BR review is required by the ETSI policy definition when a CA asserts DVCP, OVCP, or IVCP. A policy using [WEB]-tagged controls follows each stated reference, including the undated domain/IP reference, without automatically adopting the full latest BR.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
Operational implication
Record the exact policy profile and whether the dependency arises from a [WEB] tag, a DVCP/OVCP/IVCP OID, or a separate relying-party or contractual rule.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
Core obligations
ETSI EN 319 411-1
EN 319 411-1 requires a CP stating what must be adhered to and a CPS explaining how the TSP implements those requirements. Selected obligations are tagged [WEB] to mark controls that apply specifically to web-authentication certificates; DVCP, OVCP, and IVCP profiles add BRG-linked CPS duties.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
CA/B Forum BRG dependency
[WEB] controls incorporate selected BR requirements; verify whether each control cites fixed V1.8.6 [5] or undated BRG [6]. Domain and IP validation cites [6]. DVCP, OVCP, and IVCP add full-current-BR monitoring and the conflict rule that the latest BR prevails unless ETSI is more stringent.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
Evidence
ETSI EN 319 411-1
EN 319 411-1 requires the TSP to verify subscriber and subject identity, check requests for accuracy, authorization, and completeness, and collect or validate direct evidence or attestation from appropriate sources.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
CA/B Forum BRG dependency
For domain and IP information, REG-6.2.2-03A [WEB] cites clauses 3.2.2.4 through 3.2.2.9 of undated BRG [6]. Check the latest edition, its effective dates, and the referenced methods. DVCP, OVCP, and IVCP additionally require the full latest BR.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
Operational implication
Record the validation method, ETSI requirement, exact BR reference and clause, edition, effective date, and evidence. Domain and IP validation uses the undated reference even outside the full-BR policy route.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
Publication duties and BR deadlines
ETSI EN 319 411-1
EN 319 411-1 requires public CPS disclosure, availability of terms and conditions to relying parties, public international availability of those terms for publicly trusted certificates, support for OCSP or CRL, and public international availability of revocation status information.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
CA/B Forum BRG dependency
The current BR has its own effective dates and lifecycle deadlines. Those requirements must be read from the live BR for DVCP, OVCP, and IVCP rather than inferred from ETSI notes or older clause references.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
Operational implication
Track ETSI availability duties and current BR deadlines as separate cited controls; apply the stricter rule where the ETSI conflict clause requires it.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
Conflict and change control
ETSI EN 319 411-1
EN 319 411-1 V1.5.1 sets the ETSI baseline and permits confidential CPS sections. ETSI TC ESI is the relevant body for EN 319 411-1 revisions; conflicts with CA/B Forum SSL/TLS certificate policies should be reported to both ETSI TC ESI and the CA/Browser Forum.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
CA/B Forum BRG dependency
For OVCP, DVCP, and IVCP, BRG takes precedence when EN 319 411-1 conflicts with the latest BRG version, unless EN 319 411-1 is more stringent. The TSP must monitor BRG revisions and ensure compliance as requirements become effective, making BRG monitoring a live, repeating obligation.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
Operational implication
When BRG conflicts with EN 319 411-1 for DVCP, OVCP, or IVCP, BRG takes precedence unless the ETSI requirement is more stringent; retain the conflict and stringency analysis.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
CA/B Forum BRG dependency
The BR can address the same operations for publicly trusted TLS certificates, but the actors, conditions, deadlines, and evidence details must be compared requirement by requirement.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
Operational implication
A shared artifact may support both sources, but do not label a control jointly satisfied until the applicable ETSI and current BR requirements have been compared and the service boundary matches.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
Decision rule
ETSI EN 319 411-1
ETSI evidence should be organized by policy profile and service component: CP/CPS, subscriber and subject registration, certificate generation, dissemination, revocation management, revocation status, and supporting procedures.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
CA/B Forum BRG dependency
Map each [WEB] control to its stated BR reference, preserving the undated domain/IP dependency. Keep the full-current-BR mapping for DVCP, OVCP, or IVCP and separate root-program or application-software supplier rules.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, certificate policy and CPS obligations.
Operational implication
Do not infer public trust from an ETSI assessment. Public trust depends on the root being distributed by application software and on the applicable relying-party program requirements.
Grounds the general TSP policy baseline that EN 319 411-1 applies through its CPS and trust-service requirements.
General Policy Requirements for Trust Service Providers
1
Section 1
What the comparison can and cannot prove
EN 319 411-1 covers TSPs issuing public key certificates, including trusted website certificates. It contains provisions aligned with the CA/Browser Forum documents that ETSI abbreviates as EVCG and BRG, and it cites both a fixed BR V1.8.6 and an undated BR reference.
The two references do different work. Clause 3.4 describes selected BR V1.8.6 requirements for [WEB] controls, which do not by themselves require the full latest BR. However, REG-6.2.2-03A specifically cites undated BRG [6] for domain and IP validation, so each reference must be checked. By contrast, the DVCP, OVCP, and IVCP policy definitions and OVR-5.2 require the corresponding CA to follow the full latest BR, monitor revisions, and meet requirements as they become effective.
Use EN 319 411-1 as the source for CP/CPS structure, service components, ETSI policy identifiers, [WEB] tags, and ETSI conformity evidence.
For a [WEB]-only policy, record the BR reference cited by each requirement. Clause 3.4 describes selected BR V1.8.6 requirements, but REG-6.2.2-03A cites the undated BRG [6] for domain and IP validation.
For DVCP, OVCP, or IVCP, review the current TLS independently, including effective dates. The BR itself says its requirements are necessary but not sufficient for publicly trusted TLS issuance and become mandatory for a CA when adopted and enforced by relying-party application software suppliers.
Provides the live CA/Browser Forum TLS Baseline Requirements, including the current published version and the document's scope and adoption boundary.
2
Section 2
Policy profiles: where EN 319 411-1 points to BRG
EN 319 411-1 defines NCP, NCP+, and LCP as reference certificate policies, then defines EVCP, DVCP, OVCP, and IVCP for TLS/SSL certificates. DVCP, OVCP, and IVCP start with LCP and add the requirements needed for the corresponding CA/Browser Forum DV, OV, or IV certificate policy.
A CA that asserts an ETSI DVCP, OVCP, or IVCP OID in a TLS/SSL certificate is also expected by clause 4.2.2 to adhere to the corresponding CA/Browser Forum policy in the full latest BR. This is broader than adopting only the [WEB]-tagged requirements. The CP/CPS and evidence map should identify the asserted OID, the applicable BR policy, the BR version and effective date reviewed, and any additional BR requirement.
In this comparison, the web policy names distinguish Domain Validation Certificate Policy (DVCP), Organizational Validation Certificate Policy (OVCP), Individual Validation Certificate Policy (IVCP), and Extended Validation Certificate Policy (EVCP). The general reference policies are Lightweight Certificate Policy (LCP), Normalized Certificate Policy (NCP), and Extended Normalized Certificate Policy (NCP+).
List each certificate policy in scope: LCP, NCP, DVCP, OVCP, IVCP, or EVCP.
For DVCP, OVCP, and IVCP, record the ETSI policy OID, the corresponding BR policy, and the current BR version reviewed.
Do not infer that NCP, NCP+, or LCP alone satisfies the full current BR. For [WEB] controls, check each cited BR reference, including the undated reference for domain and IP validation. A browser root program or contract can impose separate requirements.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, [WEB] requirement tagging, CPS disclosure, domain/IP validation references, revocation-status expectations, and conflict rule for BRG-referenced certificate policies.
The present document includes provisions consistent with the requirements from the CA/Browser Forum in EVCG [4] and BRG [6].
3
Section 3
CPS and publication duties to compare first
EN 319 411-1 distinguishes the CP from the CPS: the CP says what quality, profile, applicability, and rules apply, while the CPS explains how the TSP implements those rules in its own organization, systems, facilities, and procedures. The standard also requires the TSP to publicly disclose its CPS online on a 24x7 basis, while allowing sensitive aspects to remain undisclosed.
For OVCP, IVCP, and DVCP, EN 319 411-1 adds BRG-linked CPS requirements and requires the TSP to check for newer BRG revisions and ensure compliance as they become effective as specified by the CA/Browser Forum. The TSP therefore needs a continuing BR change-control process.
Confirm that the CPS names the certificate profiles, signature algorithms, parameters, and implementation practices needed for each asserted policy.
Keep a public CPS URL, publication owner, and review evidence for EN 319 411-1 OVR-5.2 requirements.
For DVCP, OVCP, and IVCP, add a BRG revision-monitoring record and a decision trail for any changed requirement.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, [WEB] requirement tagging, CPS disclosure, domain/IP validation references, revocation-status expectations, and conflict rule for BRG-referenced certificate policies.
The present document includes provisions consistent with the requirements from the CA/Browser Forum in EVCG [4] and BRG [6].
4
Section 4
Validation, repository, and status checks that frequently overlap
EN 319 411-1 states that certificates issued under OVCP, DVCP, IVCP, or EVCP are publicly trusted certificates used to identify web servers accessed through TLS/SSL. REG-6.2.2-03A [WEB] points domain and IP verification methods to clauses 3.2.2.4 through 3.2.2.9 of BRG [6], the undated reference. Apply the latest edition under clause 2.1 and check the live BR text and effective dates; do not substitute the fixed V1.8.6 reference [5].
The same ETSI source gives concrete dissemination and status-service duties that should stay visible in a crosswalk: terms and conditions must be available to relying parties and, for publicly trusted certificates, publicly and internationally available; OCSP or CRL has to be supported; and revocation status information has to be publicly and internationally available.
Tie domain and IP address validation evidence to the EN 319 411-1 [WEB] requirement that refers to BRG methods.
Keep repository evidence for certificates, terms and conditions, CPS disclosure, cross-certified subordinate CA disclosure where applicable, and public availability claims.
Keep revocation evidence for OCSP or CRL support, consistency between methods when both are used, CPS documentation of delay interpretation, and public status availability.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, [WEB] requirement tagging, CPS disclosure, domain/IP validation references, revocation-status expectations, and conflict rule for BRG-referenced certificate policies.
The present document includes provisions consistent with the requirements from the CA/Browser Forum in EVCG [4] and BRG [6].
5
Section 5
Conflict handling and change monitoring
For OVCP, DVCP, and IVCP, OVR-5.2-07A requires the TSP to check for newer BR revisions and comply as they become effective. Under the conditional conflict rule in OVR-5.2-07B, the latest BR takes precedence unless EN 319 411-1 is more stringent, in which case the ETSI requirement remains applicable.
Keep a change log with the ETSI version, BR version and effective date, policy profile, exact requirements compared, stringency decision, owner, and implementation evidence. Clause 4.2.2 also asks parties to bring conflicts between the latest CA/Browser Forum TLS policy and EN 319 411-1 to ETSI TC ESI and the CA/Browser Forum.
Track EN 319 411-1 version, BRG version, effective date reviewed, impacted CP/CPS section, and implementation owner.
When conflict is suspected, preserve the exact ETSI requirement, BRG requirement, stringency assessment, and escalation decision.
Review the bridge after BRG revisions, EN 319 411-1 revisions, new certificate profiles, root-program changes, or changes to validation and revocation operations.
Grounds the EN 319 411-1 scope, CP/CPS model, DVCP/OVCP/IVCP relationship to BRG, [WEB] requirement tagging, CPS disclosure, domain/IP validation references, revocation-status expectations, and conflict rule for BRG-referenced certificate policies.
The present document includes provisions consistent with the requirements from the CA/Browser Forum in EVCG [4] and BRG [6].
6
Section 6
Evidence package for an audit-ready crosswalk
Build the evidence package around the EN 319 411-1 service components: registration, certificate generation, dissemination, revocation management, revocation status, and optional subject device provision. Then add BRG-specific references only for the profiles and [WEB] controls where EN 319 411-1 points to BRG.
The result should show what EN 319 411-1 itself requires, which BRG dependency was identified, which current BRG requirements still need independent review, and which operational record proves the control in the current assessment period.
CP/CPS map: policy OID, certificate profile, service component, public CPS location, and confidential procedure reference where sensitive details are withheld.
BRG bridge: DVCP/OVCP/IVCP requirement, BRG clause referenced by EN 319 411-1, current BRG source checked separately, and conflict/stringency result.
Operational records: subscriber and subject validation evidence, domain/IP validation evidence, issuance logs, repository publication checks, OCSP/CRL status records, revocation processing evidence, and change approvals.
Gap register: BR-only claims not established by EN 319 411-1, review owner, current CA/B Forum source still needed, and review deadline.
Grounds the general TSP policy baseline that EN 319 411-1 applies through its CPS and trust-service requirements.
General Policy Requirements for Trust Service Providers
Recommended next step
Separate ETSI CP/CPS evidence from BRG-dependent WebPKI work
Use the comparison to identify which TLS certificate-policy claims are based on EN 319 411-1 and which require a separate current CA/B Forum BR review.
Live official source for the current TLS Baseline Requirements version, scope, adoption boundary, and requirements that must be reviewed separately from the ETSI text.
Provides the live CA/Browser Forum TLS Baseline Requirements, including the current published version and the document's scope and adoption boundary.
Current official BR text and version for the independent review required by the DVCP, OVCP, and IVCP bridge.