ETSI EN 319 411-1 RA delegation

ETSI EN 319 411-1 defines a Registration Authority as the entity mainly responsible for identifying and authenticating certificate subjects, and notes that an RA can assist in the certificate application process, the revocation process, or both. Define the exact tasks in scope and the certificate policies they support. The TSP may use other parties for parts of the service, but it remains responsible for meeting the applicable policy requirements.

Document the boundary in the CP/CPS or supporting operating procedures. Separate identity proofing, certificate application intake, authorization checks, registration-data submission, revocation request handling, and evidence retention so a reviewer can see which activities are performed by the CA, by an internal RA, or by an external registration service provider.

When an external registration service provider is used, EN 319 411-1 requires registration data to be exchanged securely and only with recognized providers whose identity is authenticated. The standard also points external RAs back to general TSP security requirements for human resources, operational security, networks, and privacy.

ETSI EN 319 401 V3.2.1 supplies the current governance layer. For subcontracting, outsourcing, or other third-party arrangements, the TSP maintains overall responsibility, defines outsourcer liability, binds the provider to required controls, keeps documented agreements, and maintains an up-to-date register of direct suppliers and service providers with contact points and the ICT products, services, or processes they provide.

Delegated RA work must still support the identity validation requirements behind the certificate. EN 319 411-1 requires the TSP to verify the identity of the subscriber and subject and to collect and validate direct evidence or an attestation from an appropriate and authorized source for the identity and relevant attributes.

For registration records, the audit trail should show what evidence was presented, how documents or attestations were validated, who accepted the application, where application and subscriber-agreement records are stored, and the receiving TSP or submitting RA when applicable. The registration officer who verifies identity cannot be the natural person named as the certificate subject. These records make the delegated chain reconstructable without relying on undocumented RA judgment.

RA delegation should be reviewed whenever the delegated role, provider, certificate profile, validation source, secure exchange method, or CP/CPS wording changes. EN 319 411-1 also highlights trusted roles for registration and revocation officers, so the delegation model should show who is authorized to perform registration and revocation work and how incompatible duties are controlled.

Termination is a separate trigger. If a CA or RA relationship ends, the evidence plan should preserve registration information, revocation status information, and event log archives for their applicable and disclosed periods. Before terminating its own services, the TSP must terminate subcontractor authority to act for it and transfer evidence-maintenance obligations to a reliable party unless it can show that it holds no such information.