Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
DIRECTIVE 1999/93/EC at ANNEX I Requirements for qualified certificates states that one requirement for qualified certificates is
(a) an indication that the certificate is issued as a qualified certificate;
What is an example of this indication?
Could a qualified certificate fullfiling all the requirements in DIRECTIVE 1999/93/EC be provided? Maybe in PEM format?
An answer is provided for instance in ETSI TS 101 862 "Qualified Certificate profile":
5.3 Qualified Certificate Indication
The following two techniques can be utilized to declare that a certificate is issued as a Qualified Certificate:
1) by identifying a certificate policy in the Certificate Policies extensions, as defined in clause 4.2.1.5 from RFC 3280 [3], clearly expressing that the issuer intentionally has issued the certificate as a Qualified Certificate and that the issuer claims compliance with annex I and annex II of the Directive [1]; or
2) by including a Qualified Certificate Statements extension with an esi4-qcStatement-1 statement as defined in clause 5.2.1 of this profile.
Note that each Member State can interpret 1999/93/EC as they want, so the "qualified" quality of a certificate does not really mean much (for instance Diginotar used to deliver qualified certificates in the Netherlands). For some examples of qualified certificates used by the European Commission, see here
Comission Decision 2009/767/EC says in ANNEX 2.2: ...there is no truly interoperable and cross-border profile for the QC...
Sep 10 '13 at 0:50
There are updated ETSI standards for Qualified Certificates.
EN 319 412-5 Qualified Certificate profile defines a profile for Qualified Certificates, based on the technical definitions of the IETF RFC3739, https://www.rfc-editor.org/rfc/rfc3739.
TS 119 412-2 X.509 V3 Certificate Profile for Certificates Issued to Natural Persons defines a common profile dependant on the IETF standards for implementation of X.509 V.3 and the ETSI standard TS 101 862 (EN 319 412-5), to allow actual interoperability of certificates.
These documents describe in detail what ETSI thinks are indications of a QC.
