ETSI EN 319 411-2 qualified certificate operations

Start each qualified certificate operation with the service boundary: issuing TSP, CA or RA roles, certificate population, subject type, policy identifier, CP, CPS, subscriber terms, repository location, and relying-party notice. EN 319 411-2 incorporates EN 319 411-1 general certificate requirements, so the operating file should show both the general control baseline and the qualified-certificate additions.

Separate standards implementation from qualified-service recognition. Record the national trusted-list service entry, service digital identifier, certificate population, and status. For qualified signature and seal certificates, maintain an adaptation register for Regulation (EU) 2025/1943 instead of operating from the unmodified standard.

Qualified certificate operations begin before key or certificate generation. Apply an identity route allowed by current eIDAS Article 24 and preserve separate evidence for every certified attribute. Regulation (EU) 2025/1943 adapts the QCP-n and QCP-l clauses to refer to Article 24(1c) implementing acts, so the standard's unadapted physical-presence or equivalent-assurance wording is not the complete current legal route list.

For website authentication, verify the natural or legal person and the subscriber's link with the domain. For signature and seal certificates issued to a natural person associated with an organization, the adapted issuance rule keeps the natural person as subject identifier while the organization attributes represent the legal person or its sub-entity.

The issuance record should prove that the certificate policy identifier matches the policy applied. Clause 6.6.1 permits the profile's ETSI identifier, an allocated OID for the applied policy, or both, according to the profile-specific choice. The CP must incorporate or further constrain the applicable EN 319 411-2 requirements.

Put certificate acceptance and profile checks in the same release gate. If the subscriber agreement is electronic, EN 319 411-2 says it should be signed with an advanced electronic signature or seal. Certificates should include the appropriate qcStatements, and only QCP-n-qscd or QCP-l-qscd certificates should include the QSCD qcStatement.

For QCP-n-qscd and QCP-l-qscd, verify that the device is certified as a QSCD and the public key comes from a key pair generated by a QSCD. A controlled import between QSCD roles is conditional: the environmental assumptions and security objectives for both certified-device roles must remain met, and movement risks must be assessed and mitigated.

Where the TSP manages the QSCD, signing must occur within a QSCD. Natural-person signature keys remain under the subject's sole control; legal-person seal keys remain under the subject's control. Regulation (EU) 2025/1943 adds that a TSP managing the subject's remote QSCD must provide the corresponding qualified remote-QSCD management service.

Use the lifecycle action that matches what changes. Renewal issues a new certificate without changing the subject public key or other certificate information, apart from the new serial number and any permitted validity update. Re-key issues a new certificate with a new subject public key and may update certified attributes. Modification issues a new certificate because certificate information changes while the subject public key stays the same.

Do not carry old validation evidence forward automatically. Apply the reuse and revalidation conditions in EN 319 411-1 and the selected profile. QEVCP-w has specific EVCG-based substitutions for renewal, re-key, and modification. Record the old and new certificate identifiers, changed fields, evidence reused, checks repeated, approval, overlap period, and whether the former certificate must be revoked.

Authenticate and validate revocation or suspension requests, then publish the resulting status without exceeding the applicable deadline. Current eIDAS Article 24(3) requires a revocation to be registered in the certificate database and published in a timely manner, in any event within 24 hours after receipt of the request; revocation takes effect immediately on publication. EN 319 411-1 also requires the CPS to define the relevant processing delays and exception procedure.

EN 319 411-2 requires revocation status information beyond certificate validity through at least one method used during validity, unless the validity-assured short-certificate exception applies and the certificate carries the required extension. For CRLs, whether expired revoked certificates remain listed determines the ExpiredCertsOnCRL treatment. For OCSP, the standard describes ArchiveCutOff and a conditional final-response approach. The ETSI exception does not by itself waive the eIDAS Article 24(4) duty to provide per-certificate status beyond validity; confirm the applicable conformity-assessment and supervisory treatment before relying on it.

The CPS and terms must state the availability period and how status survives CA key compromise or TSP termination. The relying-party notice must connect qualified-certificate validation to the service digital identifier in the appropriate trusted-list entry.

Certificate operations also include changes to the qualified service itself. Article 24(2)(a) requires notice to the supervisory body at least one month before a qualified-service change and at least three months before intended cessation. Regulation (EU) 2025/2530 identifies significant changes to policies, practices, terms, architecture, hosting, cryptography, registration, governance, termination, trusted-list data, and third-party arrangements as notification subjects.

Maintain a termination plan for each qualified service. Review it at least every two years and when service changes occur. The plan must address certificate revocation where relevant, trusted-list updates, status and validation continuity, evidence preservation, subscriber and affected-party notices, third-party arrangements, and resources needed to execute the plan.