ETSI EN 319 411-2 Which QWAC profile should a QTSP use?

ETSI EN 319 411-2 defines three EU qualified website authentication certificate policy profiles: QEVCP-w, QNCP-w, and QNCP-w-gen. The profile choice is not cosmetic because the selected policy determines which EN 319 411-1 baseline, CA/Browser Forum dependency, and qualified-certificate additions must be reflected in the CP, CPS, certificate profile, and evidence pack.

Choose QEVCP-w when the qualified website certificate is issued to a legal person and follows the Extended Validation Certificate Policy route. Choose QNCP-w when the route is based on NCP plus either OVCP or IVCP. Choose QNCP-w-gen when the service is a general-purpose qualified website authentication certificate route based on NCP plus selected web-authentication requirements in EN 319 411-1.

For QEVCP-w, QNCP-w, and QNCP-w-gen, EN 319 411-2 ties initial validation to the subscriber type and the domain name. If the subscriber is a natural person, verify the subscriber identity and link with the domain name using the QCP-n route. If the subscriber is a legal person, verify the legal-person identity, authorized-representative route, and link with the domain name using the QCP-l route.

That means the evidence pack should not stop at a domain-control check. It should also show the selected QWAC policy identifier, the subscriber type, the identity route, the domain-name link, the applicable CA/Browser Forum or web-authentication dependency, and how those records are reflected in the CP, CPS, subscriber agreement, certificate contents, and repository publication.

Review the QWAC profile whenever the QTSP changes its CP/CPS, certificate profile, subscriber validation workflow, CA/RA responsibility split, repository publication process, or CA/Browser Forum dependency. The review should confirm that the public certificate policy OID and the evidence trail still describe the same qualified website authentication route.

The most useful audit file is a profile matrix: one row for each QWAC profile offered, with the policy identifier, subscriber type, EN 319 411-1 dependency, CA/Browser Forum or web-authentication dependency, identity-validation route, domain-link evidence, certificate-profile checks, and repository/status-service evidence.