From Technical Spec


a Root Certification Authority from which a certification path can be established down to a Certification Authority issuing Qualified Certificates. Only to be used as an extension, if the servicetype is http://uri.etsi.org/TrstSvc/Svctype/CA/QC

But what is the purpose of having this URI associated to a TSPService with ServiceTypeIdentifier http://uri.etsi.org/TrstSvc/Svctype/CA/QC?

Does it mean that if I have a prospective certificate path like this one:

 - A (root ca)
   - B (intermediate)
     - C (end user)

Where A is the only one registered in the TSL as a TSPService without the http://uri.etsi.org/TrstSvc/eSigDir-1999-93-EC-TrustedList/SvcInfoExt/RootCA-QC URI associated, I can't construct a valid certification path for B and C?


1 Answer 1


I just found the answer from COMMISSION DECISION 2009/767/EC

The meaning of http://uri.etsi.org/TrstSvc/eSigDir-1999-93-EC-TrustedList/SvcInfoExt/RootCA-QC additionalServiceInformation extension is stated directly in that document.

As a general default principle, for a listed CSP in the Trusted List there must be one service entry per single X.509v3 certificate for a CA/QC type certification service, i.e. a Certification Authority (directly) issuing QCs. In some carefully envisaged circumstances and carefully managed conditions, a Member State Supervisory Body/Accreditation Body may decide to use the X.509v3 certificate of a Root or Upper level CA (i.e. a Certification Authority not directly issuing end-entity QCs but certifying a hierarchy of CAs down to CAs issuing QCs to end-entities) as the Sdi of a single entry in the list of services from a listed CSP. The consequences (advantages and disadvantages) of using such X.509v3 Root CA or Upper CA as Sdi values of TL services entries must be carefully considered and endorsed by Member States. Moreover, when using this authorized exception to the default principle, Member State must provide the necessary documentation to facilitate certification path building and verification.

So the meaning and purpose of that extension is to clearly indicate (As a warning?) that the way the X.509v3 certificate is being associated to the TSP service is not under the default principle of including the direct CA for end user accredited Qualified certificates.

This would mean that in the original example without including the http://uri.etsi.org/TrstSvc/eSigDir-1999-93-EC-TrustedList/SvcInfoExt/RootCA-QC additionalServiceInformation in the TSP, constructing a certification path including B and C certificates wouldn't be appropiately supported by that TSL.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.