ETSI EN 319 411-2 How QSCD fits qualified certificate issuance

A TSP should handle QSCD by first selecting the right ETSI EN 319 411-2 qualified certificate policy. QCP-n-qscd applies to qualified certificates for natural persons where the private key corresponding to the certified public key resides in a QSCD. QCP-l-qscd applies to qualified certificates for legal persons under the same private-key-in-QSCD condition. Whether the provider and service have qualified status remains a separate eIDAS and trusted-list question.

The QSCD route brings in the ordinary QCP-n or QCP-l requirements and the NCP+ baseline, then adds QSCD-specific provisions. The standard ties those provisions to subject device provisioning, key pair and certificate usage, key generation and installation, certificate profile statements, and terms and conditions.

When the TSP manages the QSCD for the subject, ETSI EN 319 411-2 restricts use of the private key for signing to the QSCD and distinguishes natural-person sole control from legal-person control. The same area of the standard ties natural-person QSCD keys to electronic signatures and legal-person QSCD keys to electronic seals.

For key generation and installation, the TSP has to verify that the device is certified as a QSCD and ensure that the public key to be certified comes from a key pair generated by a QSCD. If a TSP generates the key pair and imports it into the signing or sealing QSCD, it must meet the certified devices' environmental assumptions and security objectives. If a private key moves between devices, it must identify compromise risks and implement adequate mitigations. The CPS must also state the measures taken when QSCD status changes during certificate validity.

Remote management has a separate legal service boundary. Under the amended eIDAS Articles 29, 29a, and 39a, generating or managing signature or seal creation data for a remote QSCD is a qualified trust service carried out by a QTSP that meets the remote-device management requirements. The transition that allowed other QTSPs to manage remote devices ended on 21 May 2026. The certificate issuer should therefore verify both the device certification and the current qualified status of any separate remote-QSCD management service.

Treat QSCD as a certificate-policy condition. If the service claims QCP-n-qscd or QCP-l-qscd, trace the evidence from the policy identifier through device certification, key generation, subject control, certificate profile, CPS text, and revocation or status-change handling.

Apply the QSCD qcStatement only to the correct certificates. ETSI EN 319 411-2 requires it for QCP-n-qscd and QCP-l-qscd certificates and prohibits it on certificates not issued under those requirements.