ETSI EN 319 411-1 ETSI EN 319 411-1 vs ETSI EN 319 411-2

EN 319 411-1 is the general certificate-service standard for TSPs issuing certificates. Scope the CA, RA, subscriber and subject roles, certificate usage, repository, revocation service, and CP/CPS commitments before mapping controls.

EN 319 411-2 is for TSPs issuing EU qualified certificates. Scope the qualified certificate policy profile, qualified website authentication certificate route if used, QTSP or qualified-status evidence, and QSCD-related route where applicable.

Start with the certificate service and policy profile. A Part 1 certificate lifecycle file can support Part 2 only when the qualified certificate scope is explicit.

Part 1 ownership usually sits with the certificate service owner, CA operations, RA or registration service provider owner, security operations, repository or status-service owner, and CP/CPS maintainer.

Part 2 adds the qualified trust service owner, qualified certificate policy owner, trusted-list evidence owner, QSCD or signing-device owner where relevant, and conformity assessment lead.

Assign owners by certificate service function and policy profile, not by a single catch-all compliance queue.

ETSI EN 319 411-1 is triggered when the TSP issues public key certificates under non-qualified certificate policy profiles, including CP/CPS, CA/RA, subscriber registration, certificate issuance, repository, and revocation-service commitments.

ETSI EN 319 411-2 is triggered when the service issues EU qualified certificates under eIDAS, including qualified certificate policy profiles, qualified website authentication certificates, QSCD-related paths, and qualified-status evidence.

Rerun the comparison when the certificate policy identifier, qualified status claim, QSCD dependency, web certificate profile, CA or RA boundary, repository, or revocation-status service changes.

Part 1 obligations center on CP/CPS structure, certificate policy identification, PKI participants, publication and repository responsibilities, identity validation, certificate lifecycle operations, revocation and status services, facility controls, technical security controls, audit logging, records archival, and CA or RA termination.

Part 2 keeps those certificate-service disciplines but applies them to qualified certificate policy profiles and qualified-service context, including QCP profiles, qualified website authentication certificate profiles, trusted-list dependencies, and QSCD-related evidence where the policy route requires it.

Create one crosswalk row per operation and identify whether the requirement is Part 1-only, Part 2-only, or a Part 2 qualified use of a Part 1 control.

ETSI EN 319 411-1 evidence should name the certificate policy and CPS version, certificate profiles, subscriber identity records, CA and RA responsibilities, issuance logs, repository and CRL/OCSP records, revocation files, and audit-period evidence.

ETSI EN 319 411-2 evidence should add the qualified certificate policy profile, qualified status or trusted-list evidence, QCP or QWAC profile mapping, QSCD-related evidence where applicable, and Part 2-specific conformity assessment findings.

Keep a traceable evidence matrix: source, claim, owner, artifact, review date, and whether the evidence satisfies ETSI EN 319 411-1, ETSI EN 319 411-2, or both.

Part 1 evidence timing is driven by certificate validity, certificate lifecycle events, revocation and status-service operation, audit logging, records archival, key changeover, and CA or RA termination records.

Part 2 timing adds qualified-service assessment and status considerations, including qualified certificate service changes and any trusted-list or qualified status evidence used for relying-party validation.

Keep retention and review dates tied to certificate validity, CP/CPS version, certificate profile, audit period, and qualified-service status rather than a broad annual checklist.

ETSI EN 319 411-1 assurance usually runs through TSP conformity assessment against EN 319 401 plus EN 319 411-1, with audit evidence tied to the non-qualified certificate policy, CPS, CA operations, RA controls, and lifecycle records.

ETSI EN 319 411-2 assurance connects the certificate audit path to eIDAS qualified trust-service supervision, qualified certificate policy profiles, QTSP status evidence, QSCD-related evidence where applicable, and qualified certificate lifecycle controls.

Escalate when an assessor, supervisory body, browser relying-party program, customer, or procurement reviewer asks for qualified certificate proof rather than ordinary certificate-service evidence.

Part 1 evidence can be reused for common PKI operations, such as lifecycle processing, revocation services, repositories, audit logging, and records archival, when the service boundary and policy profile match.

Part 2 can reuse common PKI evidence only after adding the qualified certificate policy context and any qualified-status, QWAC, trusted-list, or QSCD evidence needed for the qualified claim.

Reuse the operational artifact, not the conclusion. The same log or CP/CPS section may support both sides, but the qualified-certificate conclusion needs its own source-linked row.

Use EN 319 411-1 as the controlling side when the claim is that a TSP certificate service meets the general Part 1 certificate policy and security requirements.

Use EN 319 411-2 as the controlling side when the claim is that the service issues EU qualified certificates or uses a Part 2 qualified certificate policy profile.

Do not collapse the standards into one checklist. Start with the certificate policy profile, then show exactly which Part 1 controls are reused by the Part 2 qualified certificate claim.