Decide whether an EU qualified certificate service should use the QCP-n- or QCP-l-qscd route.
It covers device certification, key generation and import conditions, remote management qualification, certificate signals, and status-change handling.
Use QCP-n- or QCP-l-qscd only when the private key related to the certified public key resides in a certified QSCD and the full device, key, management, certificate, and status evidence supports that claim. A secure cryptographic device, smart card, hardware security module, or remote signing platform is not automatically a qualified signature or seal creation device. For remote QSCD management, apply the additional qualified-service condition in Regulation (EU) 2025/1943.
Start by separating the basic qualified-certificate policies from the policies. QCP-n and QCP-l cover EU qualified certificates for natural and legal persons. QCP-n-qscd and QCP-l-qscd add the requirement that the private key related to the certified public key resides in a QSCD.
The route changes the inherited policy baseline, certificate request checks, subscriber obligations, certificate profile, CPS disclosures, and monitoring for device-status changes. It also separates natural-person signature keys, which are under the subject's sole control, from legal-person seal keys, which are under the subject's control.
Sources (2)
Defines QCP-n, QCP-l, QCP-n-qscd, QCP-l-qscd, QEVCP-w, QNCP-w, and QNCP-w-gen, including the QSCD-specific routes for natural and legal persons.
private key related to the certified public key resides in the QSCD
Provides the EU legal context for qualified certificates and qualified signature or seal creation devices referenced by EN 319 411-2.
electronic identification and trust services
Before issuance, verify that the device is certified as a , whether the issuing TSP or another party prepared it. The request process must establish that the public key comes from a key pair generated by a QSCD.
The import clause is conditional, not a general soft-key exception. If a TSP generates the subject key pair in one and imports it into the QSCD used for signing or sealing, the environmental assumptions and security objectives for both certified-device roles must remain satisfied. If the private key moves between devices, identify key-compromise vulnerabilities and apply adequate mitigations.
If a third-party TSP manages the device on behalf of the subject, the issuer must verify the third party's appropriate qualification. Under Regulation (EU) 2025/1943, a TSP that manages the subject's remote must itself provide the corresponding qualified remote signature- or seal-device management service.
Sources (2)
Supports the issuance evidence needed for QSCD certification status, QSCD-generated key pairs, third-party managed devices, imported keys, and private-key movement.
verify that the device is certified as a QSCD
Requires a TSP managing the subject's remote QSCD to provide the corresponding qualified remote-device management service.
Use the EN 319 411-2 route, device, certificate-profile, and status-change checks before relying parties or auditors see the QSCD claim.
Turn QSCD route checks into assigned evidence requests and review gates.
Resolve policy route, certificate profile, and QSCD status questions against the cited sources.
Review the selected route, evidence gaps, and certificate-profile risks with Sorena.
The certificate profile must match the selected route. For QCP-n- and QCP-l-qscd certificates, EN 319 411-2 requires the QSCD qcStatement defined in ETSI EN 319 412-5. The same standard says that the QSCD qcStatement must not be included in certificates that are not issued according to QCP-n-qscd or QCP-l-qscd requirements.
The CP and subscriber-facing disclosure should state whether use is required. The certificate's policy identifier and QSCD qcStatement must agree with the CP, CPS, subscriber obligations, device evidence, and trusted-list scope.
Sources (1)
Supports the route-specific certificate profile checks for policy identifiers, QSCD qcStatement inclusion, and non-QSCD exclusion.
The certificate shall include the qcStatement for QSCD
The route needs monitoring after issuance because the device status can change while certificates are still valid. EN 319 411-2 requires the TSP to take appropriate measures when QSCD status changes before the certificate validity period ends and to document those measures in the CPS.
The standard points to Member State notifications on designated bodies and certified QSCDs as a monitoring source. Loss of certification status affects the validity of a non-expired certificate bearing the QSCD qcStatement and triggers the inherited revocation requirement when the TSP becomes aware of the change.
Sources (1)
Supports the need to monitor QSCD status, document measures in the CPS, and treat loss of QSCD certification status as a validity-impacting change.
measures in case of modification of the QSCD status
Use this checklist for a new profile, a CP/CPS change, a remote-management arrangement, or an existing evidence pack.
Sources (1)
Supports the checklist items by tying the QSCD route to policy selection, device verification, certificate request controls, certificate profile signals, and CPS disclosure.
whether the policy requires use of a QSCD
"Requirements for trust service providers issuing EU qualified certificates"
"whether the policy requires use of a QSCD"
"electronic identification and trust services"
"The certificate shall include the qcStatement for QSCD"
"verify that the device is certified as a QSCD"
"measures in case of modification of the QSCD status"
"private key related to the certified public key resides in the QSCD"
Operational workflow for qualified trust service providers using ETSI EN 319 411-2 to manage supervisory-body changes, incidents, termination evidence, trusted-list checks, and assessment records.
Operational guide for ETSI EN 319 411-2 qualified certificate services: policy identifiers, identity validation, issuance, QSCD handling, revocation status, and relying-party notices.
Compliance checklist for ETSI EN 319 411-2 qualified certificate services, covering policy selection, CP/CPS evidence, identity validation, QSCD status, trusted-list reliance, and certificate status services.
Answers to common ETSI EN 319 411-2 questions about EU qualified certificate policies, QSCD use, identity validation, trusted lists, and revocation status services.
How EN 319 411-2 applies identity validation for EU qualified certificates, including QCP natural-person, legal-person, website, and evidence-record checks.
Select the right ETSI EN 319 411-2 qualified certificate policy profile for signatures, seals, QSCD use, and website authentication.
Build an assessment-ready QTSP supervision evidence pack for ETSI EN 319 411-2 qualified certificate services, covering policy identifiers, trusted-list checks, incident records, QSCD evidence, and termination controls.
Use ETSI EN 319 411-2 to scope EU qualified certificate services by certificate policy, subject type, QSCD use, website authentication profile, and eIDAS context.
Map ETSI EN 319 411-2 requirements for EU qualified certificate services across QCP profiles, CP/CPS documentation, QSCD use, certificate profiles, revocation, and eIDAS Annex A references.
Build EN 319 411-2 trusted-list evidence for EU qualified certificate reliance: relying-party notice text, QTSP service identifiers, validation records, and change triggers.
Validate an EN 319 411-2 EU qualified-certificate claim by mapping the certificate service to the QTSP trusted-list entry, policy profile, relying-party notice, and status evidence.
Compare ETSI EN 319 411-2 certificate policy requirements with the eIDAS qualified-status, supervision, audit, and trusted-list framework.
Compare ETSI EN 319 411-2 EU qualified certificate requirements with EN 319 411-1 general certificate-service requirements, including policy inheritance, QSCD controls, and CP/CPS evidence reuse.
Lifecycle workflow for ETSI EN 319 411-2 qualified certificate services, from policy selection and identity validation through issuance, renewal, re-key, modification, revocation, status services, and records.
Choose the right ETSI EN 319 411-2 qualified certificate policy profile: QCP-n, QCP-l, QCP-n-qscd, QCP-l-qscd, QEVCP-w, QNCP-w, or QNCP-w-gen.
Answer the ETSI EN 319 411-2 revocation question for qualified certificate services: CPS procedures, 24-hour publication, CRL or OCSP status, and evidence to retain.
ETSI EN 319 411-2 separates qualified certificate policies for natural persons, legal persons, QSCD use, and website authentication subscribers.
A focused FAQ on choosing QCP-n, QCP-l, QCP-n-qscd, QCP-l-qscd, QEVCP-w, QNCP-w, or QNCP-w-gen under ETSI EN 319 411-2.
FAQ on EN 319 411-2 trusted-list reliance for EU qualified certificates: relying-party notices, QTSP service identifiers, validation evidence, and source references.
How ETSI EN 319 411-2 treats QSCD-backed qualified certificates, including QCP-n-qscd and QCP-l-qscd policies, key-use controls, QSCD verification, and certificate profile evidence.
How ETSI EN 319 411-2 supports QTSP supervision evidence for qualified certificate services, trusted-list reliance, liability responsibility, incident records, and audit preparation.
FAQ answer for QTSPs on how ETSI EN 319 411-2 treats EU qualified certificates, policy identifiers, QSCD variants, website certificates, and lifecycle evidence.
FAQ on ETSI EN 319 411-2 qualified certificate policies, including QCP-n, QCP-l, QSCD variants, QEVCP-w, QNCP-w, and policy identifiers.
Choose between QEVCP-w, QNCP-w, and QNCP-w-gen for qualified website authentication certificates under ETSI EN 319 411-2.