ETSI EN 319 411-2 vs ETSI EN 319 411-1

Part 2 covers issuance, maintenance, and lifecycle management of EU qualified certificates for natural persons, legal persons, QSCD-backed signature or seal routes, and website authentication.

Part 1 specifies generally applicable policy and security requirements for TSPs issuing public key certificates, including trusted website certificates and general certificate lifecycle management.

Start with the certificate policy and service scope. A Part 2 profile needs both its additional requirements and the Part 1 controls it incorporates; a general certificate service can remain within Part 1 when no qualified-certificate policy applies.

Part 2 defines QCP-n, QCP-l, QCP-n-qscd, QCP-l-qscd, QEVCP-w, QNCP-w, and QNCP-w-gen. Each policy states which Part 1 family it builds on and what qualified-certificate provisions it adds.

Part 1 defines NCP, NCP+, LCP, EVCP, DVCP, OVCP, and IVCP. The CP states what applies; the CPS describes how the TSP implements the applicable requirements.

Map the Part 2 policy to its stated Part 1 base, then verify the policy object identifier, certificate profile, subscriber type, and any QSCD or website-authentication condition before reusing evidence.

The unadapted Part 2 text describes physical-presence or equivalent-assurance routes for natural-person and legal-person identity checks, and QWAC routes also verify the subscriber's link with the domain name. For the Regulation (EU) 2025/1943 presumption-of-compliance route for qualified signature and seal certificates, the Regulation replaces those Part 2 identity clauses with verification under the implementing acts adopted pursuant to eIDAS Article 24(1c).

Part 1 covers initial identity validation, naming, subscribers and subjects, registration service responsibilities, certificate applications, and re-key or revocation request authentication for general certificate services.

For qualified signature and seal certificates, map registration evidence to current eIDAS Article 24 and the Regulation (EU) 2025/1943 adaptations; the unadapted physical-presence or equivalent-assurance wording is not the complete presumption-of-compliance route. For a website policy, also retain evidence of the subscriber's link to the domain name.

Part 2 distinguishes QSCD-backed profiles and says the QSCD qcStatement belongs in QCP-n-qscd and QCP-l-qscd certificates, while it must not be included for certificates not issued under those requirements.

Part 1 supplies the underlying NCP+ and device-related controls, but it does not establish a Part 2 QSCD-backed profile by itself.

Keep the QSCD route as a Part 2 decision. A certificate sample, device-status check, and CP/CPS statement should show when the QSCD-backed profile applies.

Part 2 evidence should include the profile decision, CP/CPS clauses, certificate samples, policy identifiers, applicable qcStatements, QSCD evidence where required, website subscriber-to-domain evidence where relevant, and conformity-assessment findings.

Part 1 evidence should include CP and CPS versions, certificate policy identifiers, subscriber agreements, identity validation records, RA delegation evidence, issuance logs, CRL or OCSP records, revocation files, repository publication records, audit logs, and records archival evidence.

Keep a traceable evidence matrix: source, claim, profile, owner, artifact, review date, and whether the artifact supports Part 2, Part 1, or both.

Part 2 repeatedly incorporates Part 1 lifecycle controls for publication, identity validation, certificate application, issuance, revocation requests, CRL, OCSP, business matters, and policy management, then adds qualified-profile constraints.

Part 1 is the operational backbone for certification services: registration, certificate generation, dissemination, revocation management, revocation status, repositories, and records archival.

Reuse operational evidence where Part 2 points back to Part 1, but keep a Part 2 row showing the qualified profile or qualified-service condition that made the reuse valid.

Part 2 maps EU qualified certificate policies to eIDAS requirements, but its annex is not a definitive legal conformance statement. Regulation (EU) 2025/1943 separately references V2.6.1 with adaptations for qualified signature and seal certificates.

Part 1 is a technical standard for general certificate-service policy and security requirements. Regulation (EU) 2025/1943 also adapts Part 1 provisions incorporated into the qualified signature and seal route.

For the legal presumption-of-compliance route, crosswalk the two ETSI editions together with the implementing regulation's adaptations. Keep supervisory, trusted-list, conformity-assessment, and qualified-status evidence separate.

Part 2 can reuse common PKI evidence after the crosswalk identifies the qualified certificate policy, the Part 1 provision being incorporated, and any additional website-authentication or QSCD condition.

Part 1 evidence can be reused for common PKI operations, such as lifecycle processing, revocation services, repositories, audit logging, and records archival, when the service boundary and policy profile match.

Reuse the operational artifact, not the conclusion. The same log or CP/CPS section may support both sides, but the qualified-certificate conclusion needs its own cited row.

Use EN 319 411-2 for the profile-specific requirements when the service issues EU qualified certificates under a Part 2 policy.

Use EN 319 411-1 as the controlling side when the claim is that a TSP certificate service meets the general Part 1 certificate policy and security requirements.

Do not collapse the standards into one checklist. Start with the qualified profile and public claim, then show exactly which Part 1 controls are reused by the Part 2 qualified certificate claim.