ETSI EN 319 411-2 Trusted-list reliance FAQ

ETSI EN 319 411-2 does not treat a trusted list as a loose background reference. In the notice to relying parties, the TSP must explain that, as one condition for relying on the certificate as an EU Qualified Certificate, the validation trust anchor is the service digital identifier in the appropriate EU trusted-list entry for the QTSP.

That means the public reliance message should name the trusted-list dependency clearly. A certificate policy OID, CA certificate, repository page, or marketing statement is not enough by itself if the question is whether the certificate can be relied on as an EU qualified certificate.

The practical evidence set should show that relying parties were told how qualified-certificate reliance depends on the relevant EU trusted-list entry. Keep the public notice text, the CP/CPS or terms section it points to, and a mapping from the certificate service to the trusted-list service digital identifier.

For operational review, retain a dated validation record showing the trusted-list source checked, the QTSP name, the service identifier, the service status considered, the certificate profile or policy OID, and the validation procedure used. This is evidence of the reliance process, not a substitute for the formal trusted list itself.

Use EN 319 411-2 to identify the relying-party notice obligation, then use the trusted-list standards it references for the validation method. ETSI TS 119 612 is referenced for the trusted-list service digital identifier; ETSI TS 119 615 is referenced for procedures for using and interpreting EU Member State national trusted lists.

If the validation question is about whether a signature or seal qualifies, keep that separate from merely checking a certificate. EN 319 411-2 points to ETSI TS 119 172-4 for a signature validation policy that describes validation against EU trusted lists for European qualified electronic signatures or seals.