DIRECTIVE 1999/93/EC at ANNEX I Requirements for qualified certificates states that one requirement for qualified certificates is

(a) an indication that the certificate is issued as a qualified certificate;

What is an example of this indication?

Could a qualified certificate fullfiling all the requirements in DIRECTIVE 1999/93/EC be provided? Maybe in PEM format?


An answer is provided for instance in ETSI TS 101 862 "Qualified Certificate profile":

5.3 Qualified Certificate Indication

The following two techniques can be utilized to declare that a certificate is issued as a Qualified Certificate:

1) by identifying a certificate policy in the Certificate Policies extensions, as defined in clause from RFC 3280 [3], clearly expressing that the issuer intentionally has issued the certificate as a Qualified Certificate and that the issuer claims compliance with annex I and annex II of the Directive [1]; or

2) by including a Qualified Certificate Statements extension with an esi4-qcStatement-1 statement as defined in clause 5.2.1 of this profile.

Note that each Member State can interpret 1999/93/EC as they want, so the "qualified" quality of a certificate does not really mean much (for instance Diginotar used to deliver qualified certificates in the Netherlands). For some examples of qualified certificates used by the European Commission, see here

  • Just like Comission Decision 2009/767/EC says in ANNEX 2.2: ...there is no truly interoperable and cross-border profile for the QC... – Jaime Hablutzel Sep 10 '13 at 0:50
  • By the way, sad what happened to Diginotar... – Jaime Hablutzel Sep 10 '13 at 18:24

There are updated ETSI standards for Qualified Certificates.

EN 319 412-5 Qualified Certificate profile defines a profile for Qualified Certificates, based on the technical definitions of the IETF RFC3739, http://tools.ietf.org/html/rfc3739.

TS 119 412-2 X.509 V3 Certificate Profile for Certificates Issued to Natural Persons defines a common profile dependant on the IETF standards for implementation of X.509 V.3 and the ETSI standard TS 101 862 (EN 319 412-5), to allow actual interoperability of certificates.

These documents describe in detail what ETSI thinks are indications of a QC.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.