Search every question across sub-FAQs

Yes, but delegation does not turn registration into an unmanaged hand-off. ETSI EN 319 411-1 defines a Registration Authority as the entity responsible mainly for identifying and authenticating certificate subjects, and notes that an RA can assist with certificate applications, revocation, or both.

For initial identity validation, the TSP must ensure that the subscriber and subject are verified, that direct evidence or an attestation from an appropriate and authorized source is collected and validated, and that certificate requests are accurate, authorized, and complete. A subcontracted person may supply identity evidence only when the identity check follows clause 6.2.2. The registration officer who verifies identity cannot be the natural person receiving the certificate.

External registration authorities are controlled trust-service participants. ETSI EN 319 411-1 requires registration data from external registration service providers to be exchanged securely and only with recognized providers whose identity is authenticated.

The same clause points external RAs back to general TSP security requirements, including human resources, operational security, networks, and privacy. ETSI EN 319 401 adds that third-party arrangements need documented agreements and clear obligations for the relevant information security requirements.

The audit file should make the delegated registration chain reconstructable. ETSI EN 319 411-1 requires registration information to be logged and recorded, including document types, unique identification data or references where applicable, storage locations, subscriber-agreement choices, the identity of the entity accepting the application, validation method, and the receiving TSP or submitting RA when applicable.

RA delegation evidence should also cover retention and exit handling. EN 319 411-1 requires specified records to be retained for at least seven years after any certificate based on those records ceases to be valid, and its RA termination clause calls out registration information, revocation status information, and event log archives.

The CA or TSP should start with the terms and conditions that explain certificate use, acceptance, obligations, and limitations. ETSI EN 319 411-1 clause 6.3.4 requires the subscriber to be informed of those terms before the contractual relationship is formed.

The agreement process also needs to be usable as evidence later. The terms must be communicated through a durable means, in human-readable form, before the agreement. Electronic transmission is allowed, but the record must still show what version was presented and how acceptance occurred.

ETSI EN 319 411-1 distinguishes the subscriber from the certificate subject. If the subscriber and subject are separate entities and the subject is a natural or legal person, the agreement shall be in two parts: one ratified by the subscriber and one ratified by the subject. The two parts may be ratified together when the subscriber is the subject legal person's official representative, or when the same official representative acts for both subscriber and subject.

That distinction matters for enterprise and delegated-certificate scenarios. The subscriber part should capture subscriber obligations, any secure-device requirement, consent to registration and revocation records, publication choices, and confirmation that certificate information is correct. The subject part should capture the subject obligations, secure-device acceptance where relevant, and consent to the records kept by the TSP.

The evidence should prove the exact agreement, the terms accepted, the person or entity accepting, and the specific choices made during registration. ETSI EN 319 411-1 requires the agreement with the subscriber to be recorded, and, where the subscriber and subject are separate, the subject agreement to be recorded as well.

Records should also connect the agreement to the registration file. ETSI EN 319 411-1 lists the storage location of applications and identification documents, including the subscriber agreement, plus specific choices in the agreement such as consent to certificate publication.

Clause 6.2.2 starts with a direct rule: the TSP verifies the identity of the subscriber and the certificate subject. It then requires the TSP to collect and validate either direct evidence or an attestation from an appropriate and authorized source for the subject's identity and, where applicable, subject attributes.

The validation decision must also cover the certificate request itself. ETSI EN 319 411-1 requires the TSP to check that certificate requests are accurate, authorized, and complete against the collected evidence or attestation. Identity verification happens at registration, but issuance may occur later. At issuance, the attributes must still be correct, the original proofing process must remain acceptable under the CPS, and the CP/CPS must define how long and how often identity validation may be reused without a new validation.

For natural-person subjects under NCP requirements, ETSI EN 319 411-1 requires identity evidence to be checked against the person directly by physical presence, unless a duly mandated subscriber represents the subject, or indirectly using means that provide equivalent assurance. The evidence set includes the person's full name and either date and place of birth, a recognized identity-document reference, or other distinguishing attributes.

For a natural person associated with a legal person, the file needs both personal and organization evidence: the subject's name and distinguishing attributes, the legal person's full name and legal status, relevant registration information, the affiliation, and approval by both the legal person and natural person that the subject attributes identify the organization. For legal-person and device/system subjects, the evidence shifts to the organization's name, registration or distinguishing attributes, relevant organizational associations, and a device identifier such as an Internet domain name where applicable.

The evidence record should be specific enough to re-perform the validation decision without collecting unnecessary long-term personal data. ETSI EN 319 411-1 requires the TSP to record all information necessary to verify the subject identity and attributes, including any reference number on verification documentation and any limits on its validity. The standard notes that long-term retention may be limited to a reference to the document used, depending on the records obligations and applicable law.

The record should also prove process integrity. Keep the request, evidence or attestation source, validation method, certificate profile, subscriber contact attributes, authorization evidence, approval history, and the registration officer or RA record. The registration officer who verifies identity must not be the natural person receiving the certificate as subject.