ETSI EN 319 411-2 requirements map

EN 319 411-2 does not define one generic certificate service. It defines EU qualified certificate policies and uses those policy indicators to decide which additional requirements apply. The first mapping step is therefore to identify the service as QCP-n, QCP-l, QCP-n-qscd, QCP-l-qscd, QEVCP-w, QNCP-w, or QNCP-w-gen.

The profile changes the baseline. QCP-n and QCP-l use NCP unless the trust service provider's (TSP's) terms require a secure cryptographic device, in which case NCP+ applies. QCP-n-qscd and QCP-l-qscd include the relevant QCP requirements, NCP+, and QSCD provisions. QEVCP-w, QNCP-w, and QNCP-w-gen use different EVCP, OVCP/IVCP, or web-tagged dependencies. For QEVCP-w and QNCP-w, the current BRG or EVCG takes precedence if it conflicts with EN 319 411-2.

Separate three layers: the certificate policy states the claimed quality and applicability, the Certification Practice Statement explains how the TSP operates the service, and the certificate carries policy identifiers that relying parties can evaluate.

Clause 6.6.1 requires at least one policy identifier allowed for the selected profile. That may be the ETSI identifier, an OID allocated to the certificate policy actually applied, or both, subject to the profile-specific choice. The CP must incorporate or further constrain all applicable clauses 5 and 6 requirements; an internal OID does not remove that traceability.

Preserve the standard's service-component structure instead of flattening the requirements into a generic checklist. EN 319 411-2 uses OVR for general requirements, GEN for certificate generation, REG for registration, REV for revocation, DIS for dissemination, SDP for subject device provisioning, and CSS for certificate status service.

Many clauses say that the corresponding EN 319 411-1 requirement applies, then add qualified-certificate-specific requirements. Treat those imports as live obligations in the map: the qualified service is not covered just because the EN 319 411-2 add-on text was reviewed.

Commission Implementing Regulation (EU) 2025/2530 adds cross-service duties beside the standards map. A QTSP must notify the supervisory body before significant changes covered by Article 1, keep a risk-management framework, maintain a termination plan for each qualified service, and review that plan at least every two years and when provider or service changes are implemented.

For QCP-n-qscd or QCP-l-qscd, map device certification, proof that the public key comes from a key pair generated by a QSCD, any key import or device-to-device movement, third-party device management, and the CPS response to a QSCD status change. Where the TSP manages a remote QSCD for the subject, Regulation (EU) 2025/1943 requires it to provide the corresponding qualified remote-QSCD management service.

Certificate content must also reflect the QSCD branch correctly. EN 319 411-2 requires the QSCD qcStatement for QCP-n-qscd and QCP-l-qscd certificates, and it says that the QSCD qcStatement must not be included in certificates that are not issued under those QSCD policies.

Regulation (EU) 2025/1943 references EN 319 411-2 V2.6.1 for qualified signature and seal certificates with adaptations. The adaptations replace or add requirements for identity validation, certificate issuance, remote QSCD management, cryptographic mechanisms, CRL preservation, personnel controls, key generation, and other areas. Build the map from the adapted text rather than marking the unmodified standard complete.

Annex A remains useful for orientation, but it maps the regulation text available when the standard was prepared. The annex itself says it is not a definitive statement of eIDAS conformance, some legal requirements are outside the standard, and the standard was not legally reviewed. Use the current consolidated Regulation and implementing acts for the legal layer.