ETSI EN 319 411-2 Which QWAC profile should a QTSP use?

ETSI EN 319 411-2 defines three EU qualified website authentication certificate policy profiles: QEVCP-w, QNCP-w, and QNCP-w-gen. The selected policy determines which EN 319 411-1 baseline, CA/Browser Forum dependency, and qualified-certificate additions must appear in the CP, CPS, certificate profile, and evidence pack.

Apply three tests in order. First, confirm the certificate is for website authentication rather than signature or seal use. Second, identify the subscriber as a natural or legal person. Third, identify the assurance package. Choose QEVCP-w only for a legal person under the Extended Validation Certificate Policy and EVCG route. Choose QNCP-w for a natural or legal person under NCP plus OVCP or IVCP and the Baseline Requirements. Choose QNCP-w-gen for the general-purpose route based on NCP plus selected WEB-tagged requirements in EN 319 411-1.

Profile selection is only one layer. Current eIDAS Article 45 requires a qualified website authentication certificate to meet Annex IV, and qualified status still depends on the issuing service's trusted-list entry. Annex IV requires, among other data, the subject's identity, address elements, operated domain names, validity period, unique certificate code, issuer signature or seal, and validity-status service information. From 6 January 2027, Commission Implementing Regulation (EU) 2025/2527 lists EN 319 411-2 V2.6.1 with QEVCP-w, QNCP-w, or QNCP-w-gen as a reference-standards route for QWACs used in transport layer security authentication outside a web-browser. It lists ETSI TS 119 411-5 V2.1.1 for other QWACs, including browser use.

The baseline names are Normalized Certificate Policy (NCP), Extended Validation Certificate Policy (EVCP), Organizational Validation Certificate Policy (OVCP), and Individual Validation Certificate Policy (IVCP). BRG means the CA/Browser Forum Baseline Requirements; EVCG means its Extended Validation Guidelines. WEB identifies requirements tagged for website authentication in EN 319 411-1.

For QEVCP-w, QNCP-w, and QNCP-w-gen, EN 319 411-2 ties initial validation to the subscriber type and the domain name. If the subscriber is a natural person, verify the subscriber identity and link with the domain name using the QCP-n route. If the subscriber is a legal person, verify the legal-person identity, authorized-representative route, and link with the domain name using the QCP-l route.

That means the evidence pack should not stop at a domain-control check. It should show the selected QWAC policy identifier, subscriber type, identity route, authority to request the certificate, link to each certified domain, applicable CA/Browser Forum or WEB-tagged dependency, Annex IV certificate contents, and the issuing service's trusted-list status. Retain the source used for the identity and domain-link check, validation time, reviewer or automated control, result, approval, issued certificate, and later revocation or renewal record.

Review the QWAC profile whenever the QTSP changes its CP/CPS, certificate profile, subscriber validation workflow, CA/RA responsibility split, repository publication process, or CA/Browser Forum dependency. The review should confirm that the public certificate policy OID and the evidence trail still describe the same qualified website authentication route.

The most useful audit file is a profile matrix: one row for each QWAC profile offered, with the policy identifier, subscriber type, EN 319 411-1 dependency, CA/Browser Forum or web-authentication dependency, identity-validation route, domain-link evidence, certificate-profile checks, and repository/status-service evidence.