3

DIRECTIVE 1999/93/EC at ANNEX I Requirements for qualified certificates states that one requirement for qualified certificates is

(a) an indication that the certificate is issued as a qualified certificate;

What is an example of this indication?

Could a qualified certificate fullfiling all the requirements in DIRECTIVE 1999/93/EC be provided? Maybe in PEM format?

0

2 Answers 2

1

An answer is provided for instance in ETSI TS 101 862 "Qualified Certificate profile":

5.3 Qualified Certificate Indication

The following two techniques can be utilized to declare that a certificate is issued as a Qualified Certificate:

1) by identifying a certificate policy in the Certificate Policies extensions, as defined in clause 4.2.1.5 from RFC 3280 [3], clearly expressing that the issuer intentionally has issued the certificate as a Qualified Certificate and that the issuer claims compliance with annex I and annex II of the Directive [1]; or

2) by including a Qualified Certificate Statements extension with an esi4-qcStatement-1 statement as defined in clause 5.2.1 of this profile.

Note that each Member State can interpret 1999/93/EC as they want, so the "qualified" quality of a certificate does not really mean much (for instance Diginotar used to deliver qualified certificates in the Netherlands). For some examples of qualified certificates used by the European Commission, see here

2
  • Just like Comission Decision 2009/767/EC says in ANNEX 2.2: ...there is no truly interoperable and cross-border profile for the QC... Sep 10, 2013 at 0:50
  • By the way, sad what happened to Diginotar... Sep 10, 2013 at 18:24
1

There are updated ETSI standards for Qualified Certificates.

EN 319 412-5 Qualified Certificate profile defines a profile for Qualified Certificates, based on the technical definitions of the IETF RFC3739, https://www.rfc-editor.org/rfc/rfc3739.

TS 119 412-2 X.509 V3 Certificate Profile for Certificates Issued to Natural Persons defines a common profile dependant on the IETF standards for implementation of X.509 V.3 and the ETSI standard TS 101 862 (EN 319 412-5), to allow actual interoperability of certificates.

These documents describe in detail what ETSI thinks are indications of a QC.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .