ETSI EN 319 411-2 How should QTSPs choose the right qualified certificate profile

Start with the relying-party purpose and subject type. EN 319 411-2 defines separate policy identifiers for qualified certificates issued to natural persons, qualified certificates issued to legal persons, qualified certificates tied to a QSCD, and qualified website authentication certificates.

For signatures, the natural-person route is QCP-n, and QCP-n-qscd is used where the private key related to the certified public key resides in a QSCD. For seals, the legal-person route is QCP-l, and QCP-l-qscd is used where the private key resides in a QSCD. For website authentication, EN 319 411-2 separates QEVCP-w, QNCP-w, and QNCP-w-gen depending on the certificate route and the assurance model behind it. QEVCP-w follows EVCG-based requirements, QNCP-w follows BRG-based requirements for natural or legal persons, and QNCP-w-gen is the general-purpose website-authentication route.

If the choice is still unclear, use the subject and assurance model as the tie-breaker: natural person plus signature points to QCP-n or QCP-n-qscd, legal person plus seal points to QCP-l or QCP-l-qscd, legal-person website authentication usually points to QEVCP-w, and natural or legal person website authentication under BRG points to QNCP-w. Use QNCP-w-gen when the website certificate needs the general-purpose route defined in EN 319 411-2 rather than the BRG or EVCG-specific route.

The record should show why the certificate policy and certificate contents match the qualified service being offered. EN 319 411-2 says that including one of its policy identifiers indicates the certificate is issued and managed according to that policy, so the identifier should not be treated as a cosmetic label.

For a QSCD profile, the record needs more than a policy name. It should show why the service uses the -qscd route, how the QSCD condition is reflected in the certificate policy or CPS, and how the certificate contents handle the QSCD statement required for those profiles.

Review the selected profile whenever the certificate purpose, subject population, QSCD handling, website-authentication route, policy OID, CPS wording, or certificate content changes. A profile that was correct for a non-QSCD natural-person certificate may be wrong after a QSCD service launch, and a signature or seal profile does not substitute for a website-authentication profile.

The review should compare the certificate policy, CPS, terms and conditions, certificate profile, and issuance process against the selected EN 319 411-2 policy family before new certificates are issued under the changed route.