Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In ETSI TS 102 231 sec. 5.5.3 Service digital identity, says about "Service digital identity":

... When using public-key technology (i.e. PKI), this field MUST be a representation of the public key(s) the TSP uses for providing its services; e.g. the key used for signing certificates or OCSP responses.

So what are the valid options for "Service digital identity" for a service with a Service type identifier of http://uri.etsi.org/TrstSvc/Svctype/RA?

ETSI TS 119 612 (Intended to supersede ETSI TS 102 231) says in sec. 5.5.3 Service digital identity:

When using PKI public-key technology, the service digital identifier uniquely and unambiguously identifying the service shall be a public key associated with the TSP service and used to verify the authenticity of the provided service.

So I could think that a SSL certificate for the RA web site could be considered valid for the "Service digital identity". But this isn't clear to me that the spec is going in that direction, furthermore here is an example of a TSL:


where the RA service digital identity is the same that the CA certificate but it has been issued specially for that RA, so it has the word LRA (Local Registration Authority):

CN=BT/DigitalSign Qualified CA,OU=Class 2 Managed PKI Individual Subscriber CA,OU=Terms of use at https://www.trustwise.com/rpa (c)08,OU=VeriSign Trust Network,OU=LRA - DigitalSign Certificadora Digital (PT507015851),O=British Telecommunications plc,C=GB

, so in that case that certificate seems to be completely OK, but it is not the situation all times.

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.