ETSI EN 319 411-2 Qualified certificate policies FAQ

ETSI EN 319 411-2 defines seven EU qualified certificate policies. QCP-n covers EU qualified certificates issued to natural persons, and QCP-l covers EU qualified certificates issued to legal persons. QCP-n-qscd and QCP-l-qscd are the corresponding policies when the private key related to the certified public key must reside in a qualified signature or seal creation device.

For qualified website authentication certificates, QEVCP-w is based on EVCP, QNCP-w is based on NCP plus OVCP or IVCP, and QNCP-w-gen is based on NCP plus requirements tagged as WEB in ETSI EN 319 411-1. The selected policy should be visible in the CP/CPS, terms and conditions, certificate profile, and policy identifier evidence.

The ETSI policy OIDs are 0.4.0.194112.1.0 for QCP-n, 0.4.0.194112.1.1 for QCP-l, 0.4.0.194112.1.2 for QCP-n-qscd, 0.4.0.194112.1.3 for QCP-l-qscd, 0.4.0.194112.1.4 for QEVCP-w, 0.4.0.194112.1.5 for QNCP-w, and 0.4.0.194112.1.6 for QNCP-w-gen. EN 319 411-2 also permits an OID allocated by the TSP or another stakeholder, but the policy it identifies must state which EN 319 411-2 policy it uses as its basis.

Apply the choice in four steps. First identify the intended use: signature, seal, or website authentication. Second identify the subject as a natural person or legal person. Third decide whether the signature or seal key must reside in a QSCD. Fourth, for website authentication, select the EV, organization or individual validation, or general-purpose assurance route. A certificate intended for another use is outside these seven policy profiles.

Then check the device and baseline inheritance. EN 319 411-2 states that QCP-n and QCP-l use NCP unless the TSP terms and conditions require a secure cryptographic device, in which case NCP+ applies. The QSCD-specific policies include the corresponding QCP policy plus QSCD provisions. Website routes inherit EVCP, NCP, OVCP or IVCP, and WEB-tagged requirements as applicable.

The evidence should prove that the selected policy identifier matches the certificate type and the service actually operated. Keep the CP/CPS section that names the policy, the certificate profile showing the policy OID, the terms and conditions that determine secure-device use, and issuance or audit evidence showing whether the service follows the inherited EN 319 411-1 requirements. Sample issued certificates and trace each one back through identity validation, approval, profile generation, publication, status service, and revocation handling.

Do not treat Annex A as a legal conformance certificate. EN 319 411-2 says the annex maps policy references to eIDAS requirements, but also warns that the annex is not a definitive statement of conformance to eIDAS and that non-technical legal requirements are outside the standard's scope.