ETSI EN 319 411-2 ETSI EN 319 411-2 vs ETSI EN 319 411-1

Part 2 is scoped to requirements for trust service providers issuing EU qualified certificates, including qualified certificate policies for natural persons, legal persons, QSCD-backed certificates, and qualified website authentication certificates.

Part 1 specifies generally applicable policy and security requirements for TSPs issuing public key certificates, including trusted website certificates and general certificate lifecycle management.

Start with the public claim. A qualified certificate claim needs Part 2 evidence; an ordinary certificate-service claim can stay in the Part 1 evidence boundary.

Part 2 names qualified profiles such as QCP-n, QCP-l, QCP-n-qscd, QCP-l-qscd, QEVCP-w, QNCP-w, and QNCP-w-gen, and requires certificate policy statements to make the qualified and QSCD posture clear.

Part 1 uses general certificate policy concepts such as NCP, LCP, EVCP, DVCP, OVCP, and IVCP, with CP describing what applies and CPS describing how the TSP implements it.

Do not map by acronym alone. Match the policy object identifier, certificate profile, subscriber type, and qualified-status claim before reusing evidence.

Part 2 adds qualified-certificate identity routes: natural-person and legal-person identities must be verified by physical presence or methods with equivalent assurance, and QWAC routes must also verify the subscriber link with the domain name.

Part 1 covers initial identity validation, naming, subscribers and subjects, registration service responsibilities, certificate applications, and re-key or revocation request authentication for general certificate services.

Use Part 1 records for common registration controls, but add Part 2 proof where the qualified profile requires natural-person, legal-person, domain-link, or equivalent-assurance evidence.

Part 2 distinguishes QSCD-backed profiles and says the QSCD qcStatement belongs in QCP-n-qscd and QCP-l-qscd certificates, while it must not be included for certificates not issued under those requirements.

Part 1 handles general secure cryptographic device and certificate profile evidence, but it does not turn a certificate into a qualified QSCD-backed certificate by itself.

Keep the QSCD route as a Part 2 decision. A certificate sample, device-status check, and CP/CPS statement should show when the QSCD-backed profile applies.

Part 2 evidence should include the qualified profile decision, CP/CPS clauses, qualified status context, certificate samples, qcStatements, QSCD route where applicable, trusted-list checks, QWAC domain-link evidence where relevant, and conformity-assessment findings.

Part 1 evidence should include CP and CPS versions, certificate policy identifiers, subscriber agreements, identity validation records, RA delegation evidence, issuance logs, CRL or OCSP records, revocation files, repository publication records, audit logs, and records archival evidence.

Keep a traceable evidence matrix: source, claim, profile, owner, artifact, review date, and whether the artifact supports Part 2, Part 1, or both.

Part 2 repeatedly incorporates Part 1 lifecycle controls for publication, identity validation, certificate application, issuance, revocation requests, CRL, OCSP, business matters, and policy management, then adds qualified-profile constraints.

Part 1 is the operational backbone for certification services: registration, certificate generation, dissemination, revocation management, revocation status, repositories, and records archival.

Reuse operational evidence where Part 2 points back to Part 1, but keep a Part 2 row showing the qualified profile or qualified-service condition that made the reuse valid.

Part 2 maps EU qualified certificate policies to eIDAS qualified trust-service requirements, but its annex warns that the mapping is not a definitive legal conformance statement and that some Regulation requirements are outside the technical standard.

Part 1 is a technical standard for certificate-service policy and security requirements and points to EN 319 403 for conformity assessment of TSP processes and services.

Do not claim eIDAS qualified status from the ETSI comparison alone. Keep supervisory, trusted-list, conformity-assessment, and legal-context evidence separate from the standard crosswalk.

Part 2 can reuse common PKI evidence only after adding the qualified certificate policy context and any qualified-status, QWAC, trusted-list, or QSCD evidence needed for the qualified claim.

Part 1 evidence can be reused for common PKI operations, such as lifecycle processing, revocation services, repositories, audit logging, and records archival, when the service boundary and policy profile match.

Reuse the operational artifact, not the conclusion. The same log or CP/CPS section may support both sides, but the qualified-certificate conclusion needs its own source-linked row.

Use EN 319 411-2 as the controlling side when the service issues EU qualified certificates or uses a Part 2 qualified certificate policy profile.

Use EN 319 411-1 as the controlling side when the claim is that a TSP certificate service meets the general Part 1 certificate policy and security requirements.

Do not collapse the standards into one checklist. Start with the qualified profile and public claim, then show exactly which Part 1 controls are reused by the Part 2 qualified certificate claim.