ETSI EN 319 411-2 How should QTSPs choose the right qualified certificate profile

Use five inputs: intended use, subject type, QSCD condition, website assurance route, and issuing service scope. EN 319 411-2 defines separate policy identifiers for qualified certificates issued to natural persons, qualified certificates issued to legal persons, qualified certificates tied to a QSCD, and a QWAC. If the intended use is outside signature, seal, or website authentication, these seven profiles do not answer the certificate-policy question.

For signatures, the natural-person route is QCP-n, and QCP-n-qscd is used where the private key related to the certified public key resides in a QSCD. For seals, the legal-person route is QCP-l, and QCP-l-qscd is used where the private key resides in a QSCD. For website authentication, EN 319 411-2 separates QEVCP-w, QNCP-w, and QNCP-w-gen depending on the certificate route and the assurance model behind it. QEVCP-w follows EVCG-based requirements, QNCP-w follows BRG-based requirements for natural or legal persons, and QNCP-w-gen is the general-purpose website-authentication route.

Use the subject and assurance model together. A natural-person signature route points to QCP-n or QCP-n-qscd, and a legal-person seal route points to QCP-l or QCP-l-qscd. For website authentication, QEVCP-w applies only to the EVCP and EVCG route for a legal person; QNCP-w applies to a natural or legal person under NCP plus IVCP or OVCP and the Baseline Requirements; QNCP-w-gen is the general-purpose NCP and WEB-tagged route. Do not choose QEVCP-w merely because the subscriber is a legal person.

The record should show why the certificate policy and certificate contents match the qualified service being offered. EN 319 411-2 says that including one of its policy identifiers indicates the certificate is issued and managed according to that policy. The identifier does not replace the separate eIDAS checks for certificate contents and trusted-list status. Retain the decision inputs, approver, effective date, sample certificate, automated profile test result, and link to the CP, CPS, terms, identity workflow, and issuance configuration.

For a QSCD profile, record why the service uses the -qscd route, how the certificate policy or CPS expresses the QSCD condition, and how the certificate includes the required QSCD statement.

Review the selected profile before first issuance and whenever the certificate purpose, subject population, QSCD handling, website-authentication route, policy OID, CPS wording, certificate content, inherited standard, CA/Browser Forum requirement, or trusted-list service scope changes. A profile that was correct for a non-QSCD natural-person certificate may be wrong after a QSCD service launch, and a signature or seal profile does not substitute for a website-authentication profile.

The review should compare the certificate policy, CPS, terms and conditions, certificate profile, and issuance process against the selected EN 319 411-2 policy family before new certificates are issued under the changed route.