ETSI EN 319 411-2 QSCD Route

Start by separating the basic qualified-certificate policies from the QSCD policies. QCP-n and QCP-l cover EU qualified certificates for natural and legal persons. QCP-n-qscd and QCP-l-qscd add the requirement that the private key related to the certified public key resides in a QSCD.

The QSCD route changes the inherited policy baseline, certificate request checks, subscriber obligations, certificate profile, CPS disclosures, and monitoring for device-status changes. It also separates natural-person signature keys, which are under the subject's sole control, from legal-person seal keys, which are under the subject's control.

Before issuance, verify that the device is certified as a QSCD, whether the issuing TSP or another party prepared it. The request process must establish that the public key comes from a key pair generated by a QSCD.

The import clause is conditional, not a general soft-key exception. If a TSP generates the subject key pair in one QSCD and imports it into the QSCD used for signing or sealing, the environmental assumptions and security objectives for both certified-device roles must remain satisfied. If the private key moves between devices, identify key-compromise vulnerabilities and apply adequate mitigations.

If a third-party TSP manages the device on behalf of the subject, the issuer must verify the third party's appropriate qualification. Under Regulation (EU) 2025/1943, a TSP that manages the subject's remote QSCD must itself provide the corresponding qualified remote signature- or seal-device management service.

The certificate profile must match the selected route. For QCP-n-qscd and QCP-l-qscd certificates, EN 319 411-2 requires the QSCD qcStatement defined in ETSI EN 319 412-5. The same standard says that the QSCD qcStatement must not be included in certificates that are not issued according to QCP-n-qscd or QCP-l-qscd requirements.

The CP and subscriber-facing disclosure should state whether QSCD use is required. The certificate's policy identifier and QSCD qcStatement must agree with the CP, CPS, subscriber obligations, device evidence, and trusted-list scope.

The QSCD route needs monitoring after issuance because the device status can change while certificates are still valid. EN 319 411-2 requires the TSP to take appropriate measures when QSCD status changes before the certificate validity period ends and to document those measures in the CPS.

The standard points to Member State notifications on designated bodies and certified QSCDs as a monitoring source. Loss of QSCD certification status affects the validity of a non-expired certificate bearing the QSCD qcStatement and triggers the inherited revocation requirement when the TSP becomes aware of the change.

Use this checklist for a new profile, a CP/CPS change, a remote-management arrangement, or an existing QSCD evidence pack.