ETSI EN 319 411-2 How should qualified trust service providers handle qualified certificates under ETSI EN 319 411-2

Start by separating ETSI policy conformance from EU qualification status. EN 319 411-2 says it incorporates the general certificate policy and security requirements from EN 319 411-1 and adds requirements intended to meet eIDAS requirements for TSPs issuing EU qualified certificates, but it also states that conformance to the standard alone does not imply that the TSP or its certificates are qualified under eIDAS.

For each certificate service, identify which EN 319 411-2 policy family is being used: QCP-n for qualified certificates issued to natural persons, QCP-l for legal persons, QCP-n-qscd or QCP-l-qscd when the related private key resides in a QSCD, and QEVCP-w, QNCP-w, or QNCP-w-gen for qualified website authentication certificates. The selected policy drives the certificate-policy statement, CPS controls, certificate profile, subscriber obligations, and evidence set.

The evidence should prove that the certificate was issued and managed under the claimed EN 319 411-2 policy, not merely that the organization has a PKI program. Keep the certificate policy, Certification Practice Statement, terms and conditions, certificate profile, identity-verification record, status-service evidence, and revocation records aligned to the selected QCP route.

For QSCD-backed QCP-n-qscd and QCP-l-qscd certificates, the evidence needs to show the QSCD basis, including the certificate profile treatment of the ETSI EN 319 412-5 QSCD qcStatement and the standard's rule that the QSCD statement is not included in certificates outside those QSCD policies.

Use the checklist to prevent the common error of treating all certificates, all certificate policies, or all QTSP services as interchangeable. The useful review is certificate-policy specific and should be repeated when the certificate profile, CPS, QSCD route, website certificate route, trusted-list status, or relevant ETSI/eIDAS source changes.