Artifact GuideGLOBALETSI EN 319 411-2

ETSI EN 319 411-2 How QSCD fits qualified certificate issuance

ETSI EN 319 411-2 uses QSCD-specific qualified certificate policies when the private key related to the certified public key resides in a qualified signature or seal creation device.

Use this FAQ to separate QCP-n-qscd and QCP-l-qscd evidence from ordinary qualified certificate evidence.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

May 9, 2026

Questions

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated May 9, 2026

Overview

Short answer: for ETSI EN 319 411-2, QSCD is not a general security label. It changes the certificate policy route, key-use controls, certificate profile, and CPS evidence for qualified certificates issued under QCP-n-qscd or QCP-l-qscd.

Search this module

Find a question or answer quickly

3 of 3 questions

Question 1

How should qualified trust service providers handle QSCD under ETSI EN 319 411-2?

A QTSP should handle QSCD by first selecting the right ETSI EN 319 411-2 qualified certificate policy. QCP-n-qscd applies to qualified certificates for natural persons where the private key and related certificate reside on a QSCD. QCP-l-qscd applies to qualified certificates for legal persons where the private key and related certificate reside on a QSCD.

The QSCD route brings in the ordinary QCP-n or QCP-l requirements and the NCP+ baseline, then adds QSCD-specific provisions. The standard ties those provisions to subject device provisioning, key pair and certificate usage, key generation and installation, certificate profile statements, and terms and conditions.

Record whether the certificate is QCP-n-qscd or QCP-l-qscd, not just that it is an EU qualified certificate.
Show that the private key related to the certified public key resides in the QSCD for the selected policy route.
Keep CPS and certificate profile evidence aligned with the QSCD route, including the required QSCD qcStatement only for QCP-n-qscd or QCP-l-qscd certificates.

Citations

ETSI EN 319 411-2 V2.6.1 EU qualified certificate requirements

Defines QCP-n-qscd and QCP-l-qscd as ETSI EN 319 411-2 policy routes where the private key and related certificate reside on a QSCD.

Regulation (EU) No 910/2014 (eIDAS)

Referenced by ETSI EN 319 411-2 for EU qualified certificate context and for the legal definition of a qualified electronic signature or seal creation device.

Question 2

What QSCD controls does ETSI EN 319 411-2 call out?

When the TSP manages the QSCD for the subject, ETSI EN 319 411-2 restricts use of the private key for signing to the QSCD and distinguishes natural-person sole control from legal-person control. The same area of the standard ties natural-person QSCD keys to electronic signatures and legal-person QSCD keys to electronic seals.

For key generation and installation, the TSP has to verify that the device is certified as a QSCD, ensure the public key to be certified comes from a key pair generated by a QSCD, address third-party managed devices where applicable, and document CPS measures for changes in QSCD status during the certificate validity period.

For QCP-n-qscd, preserve evidence that the subject's private key is used under the subject's sole control.
For QCP-l-qscd, preserve evidence that the subject's private key is used under the subject's control.
For certificate issuance, preserve proof of QSCD certification status, key-generation route, third-party TSP qualification where used, and CPS handling of QSCD status changes.

Citations

ETSI EN 319 411-2 V2.6.1 EU qualified certificate requirements

Supports the QSCD-specific requirements for private-key use, subject control, QSCD certification verification, public-key origin, third-party managed devices, and QSCD status changes.

ETSI EN 319 411-1 V1.5.1 certificate policy and security requirements

Provides the base certificate policy, lifecycle, revocation, repository, and cryptographic module controls that ETSI EN 319 411-2 incorporates before adding QSCD-specific qualified certificate requirements.

Regulation (EU) No 910/2014 (eIDAS)

ETSI EN 319 411-2 points to eIDAS Annex II and device certification rules when explaining QSCD certification expectations.

Question 3

What mistakes should QTSP teams avoid with QSCD evidence?

The main risk is treating QSCD as a marketing or procurement attribute instead of a certificate-policy condition. If the service claims QCP-n-qscd or QCP-l-qscd, the evidence must trace from the policy identifier through device certification, key generation, subject control, certificate profile, CPS text, and revocation or status-change handling.

Another common error is putting the QSCD qcStatement on the wrong certificates. ETSI EN 319 411-2 requires the QSCD qcStatement for QCP-n-qscd and QCP-l-qscd certificates and says it must not be included for certificates that are not issued under those requirements.

Do not cite QCP-n or QCP-l evidence alone as proof of a QSCD-backed policy route.
Do not rely on a device name or supplier assertion without evidence that the device is certified as a QSCD for the relevant use.
Do not leave the CPS silent on measures for QSCD status changes before certificate expiry.

Citations

ETSI EN 319 411-2 V2.6.1 EU qualified certificate requirements

Supports the warning against misplaced QSCD claims by requiring the QSCD qcStatement only on certificates issued under QCP-n-qscd or QCP-l-qscd requirements.

ETSI EN 319 411-1 V1.5.1 certificate policy and security requirements

Supplies the underlying certificate lifecycle and revocation framework that ETSI EN 319 411-2 references when QSCD status changes can affect non-expired certificates.

Regulation (EU) No 910/2014 (eIDAS)

Provides the EU legal context for qualified trust services and QSCD certification that ETSI EN 319 411-2 maps into certificate policy requirements.

Recommended next step

Map QCP-n-qscd and QCP-l-qscd controls to owned evidence

Use this ETSI EN 319 411-2 guidance to connect policy selection, QSCD certification, key-use controls, certificate profile statements, and CPS commitments.

Assessment workflow

Build the evidence map

Convert QSCD policy requirements into accountable controls, evidence requests, and review gates.

Explore next step

Research workflow

Check a QSCD interpretation

Use cited research support when certificate policy, qcStatement, device status, or third-party TSP scope is unclear.

Explore next step

Talk to Sorena

Talk through QSCD evidence

Review certificate scope, device evidence, CPS commitments, owners, and next compliance actions with Sorena.

Explore next step

Primary sources

References and citations

ETSI EN 319 411-1 V1.5.1 certificate policy and security requirements

etsi.org

Referenced sections

Supplies the underlying certificate lifecycle and revocation framework that ETSI EN 319 411-2 references when QSCD status changes can affect non-expired certificates.

"Policy and security requirements for Trust Service Providers issuing certificates"

ETSI EN 319 411-2 V2.6.1 EU qualified certificate requirements

etsi.org

Referenced sections

Supports the warning against misplaced QSCD claims by requiring the QSCD qcStatement only on certificates issued under QCP-n-qscd or QCP-l-qscd requirements.