ETSI EN 319 411-2 Qualified Certificate Scope

ETSI EN 319 411-2 is not a general PKI checklist. It addresses issuance, maintenance, and lifecycle management of EU qualified certificates. It imports general policy and security requirements from ETSI EN 319 411-1 and adds requirements for qualified signature, seal, and website authentication certificate policies.

The scope record should name the issuing trust service provider (TSP), the certification service components, the certificate population, the claimed policy identifier, and the relying-party use. Keep three layers separate: conformance to the standard, compliance with the binding eIDAS framework and applicable implementing regulations, and the qualified status of the particular service shown in the national trusted list.

Select one EN 319 411-2 policy before mapping requirements. The choice determines the subject, intended certificate use, inherited EN 319 411-1 policy family, QSCD conditions, and any CA/Browser Forum dependency.

For signature and seal certificates, Regulation (EU) 2025/1943 references EN 319 411-2 V2.6.1 with binding adaptations, including changes to identity validation, remote QSCD management, cryptographic controls, and certificate issuance. For qualified website authentication certificates issued for transport layer security authentication outside a web-browser, Regulation (EU) 2025/2527 lists QEVCP-w, QNCP-w, and QNCP-w-gen as reference routes and applies from 6 January 2027; until then, teams must keep that future application date distinct from the standard's publication.

Answer each question that changes the requirement set before issuance. The CP, CPS, terms and conditions, subscriber obligations, certificate profile, and relying-party notice should give consistent answers.

Keep a profile matrix with the subject type, policy identifier, inherited Part 1 family, applicable EU adaptation, QSCD dependency, certificate purpose, website-authentication route, trusted-list service identifier, and owner for each evidence record.

The scope decision should be reviewable without asking the reader to infer why a profile was chosen. Keep evidence at the level of the actual service: the CP/CPS clause, the certificate policy identifier, the terms and conditions, the subscriber or subject identity record, the QSCD evidence where applicable, the certificate profile, and the relying-party notice.

For QSCD profiles, the evidence must show more than an internal design preference. EN 319 411-2 includes requirements for verifying QSCD certification, ensuring the public key to be certified is from a QSCD-generated key pair, handling QSCD status changes, and including or excluding the QSCD qcStatement according to the selected policy.

Profile mixing and generic qualified-status claims create avoidable review failures. Resolve profile-specific assumptions before the CP, CPS, certificate profile, and service evidence diverge.

A scope file should establish why the selected policy route fits the service and identify the next evidence set. It cannot by itself prove eIDAS compliance or qualified status.