ETSI EN 319 411-2 Trusted-list reliance FAQ

ETSI EN 319 411-2 requires the relying-party notice to state that, as one condition for relying on the certificate as an EU Qualified Certificate, the validation trust anchor is identified in the service digital identifier of the appropriate EU trusted-list entry for the QTSP. This is a condition of the qualified-certificate reliance path, not a general statement that every certificate chaining to the provider is qualified.

That means the public reliance message should name the trusted-list dependency clearly. Under eIDAS Articles 21 and 22, a provider may begin a qualified service only after its qualified status appears in the trusted list, and each national list identifies both the QTSP and its qualified services. A certificate policy OID, CA certificate, repository page, or provider claim is not enough by itself.

The practical evidence set should show that relying parties were told how qualified-certificate reliance depends on the relevant EU trusted-list entry. Keep the public notice text, the CP/CPS or terms section it points to, and a mapping from the certificate service to the trusted-list service digital identifier.

For operational review, retain a dated validation record showing the trusted-list source checked, list signature or seal authentication result, QTSP name, service type and identifier, service status and status history considered, certificate profile or policy OID, path-validation result, revocation result, validation time, and procedure version. For a signature or certificate created in the past, validate status at the relevant time rather than relying only on the entry's current status. The record documents the reliance process; it does not replace the signed or sealed trusted list.

Use EN 319 411-2 to identify the relying-party notice obligation, then use the current trusted-list standards for the validation method. ETSI TS 119 612 V2.4.1 defines the trusted-list format and service digital identifier. ETSI TS 119 615 V1.3.1 specifies procedures for obtaining, authenticating, using, and interpreting EU Member State national trusted lists, including status at a specified date and time. Pin the procedure and trusted-list version used so a later reviewer can reproduce the result.

If the validation question is about whether a signature or seal qualifies, keep that separate from merely checking a certificate. EN 319 411-2 points to ETSI TS 119 172-4 for a signature validation policy that describes validation against EU trusted lists for European qualified electronic signatures or seals.