Qualified Certificate

A qualified certificate is a certificate for electronic signatures that meets two conditions. A qualified trust service provider issued it, and it contains everything listed in Annex I of the eIDAS Regulation. Both conditions come from Article 3(15). A certificate that misses either one may work perfectly well in software, but it is not qualified.

The certificate itself is defined one step earlier. Under Article 3(14), a certificate for electronic signature is an electronic attestation that links electronic signature validation data to a natural person and confirms at least that person's name or pseudonym. Validation data is the data used to check a signature (Article 3(40)). In practice it is the public key that matches the signer's private key. The certificate is therefore a statement, signed by the provider, that a particular key belongs to a particular person.

That statement is what turns a calculation into evidence about a person. A digital signature shows which key signed a document. Only the certificate says whose key it was. With a qualified certificate, the statement comes from a provider that a public authority supervises.

The regulation has three kinds of qualified certificate. The one for electronic signatures is issued to a natural person. The one for electronic seals is issued to a legal person (Article 3(29) and (30)). The one for website authentication links a website to the person or organisation behind it (Article 3(38) and (39)). In everyday use the term means the first, the certificate for electronic signatures.

A qualified certificate contains the items listed in Annex I of the regulation, points (a) to (j). Each of the first nine answers a question that someone relying on a signature would ask. The table groups them by that question.

The last item applies only in some cases. Where the signatory's signature creation data is located in a qualified electronic signature creation device, the certificate must say so, again in a form that software can read (Annex I, point (j)). That marker lets validation software tell a qualified signature apart from an advanced signature that rests on a qualified certificate.

The list is a ceiling as well as a floor. Article 28(2) says a qualified certificate must not be subject to any mandatory requirement that exceeds Annex I, so no member state can demand a national extra. A provider may add optional attributes of its own, as long as they do not affect the interoperability or recognition of qualified signatures (Article 28(3)).

The regulation does not prescribe a file format. In practice a qualified certificate is an X.509 certificate, the format also used to secure websites. ETSI publishes the profile that says which field carries each Annex I item.

The identity of the person who will hold it. Article 24(1) requires a qualified trust service provider to verify the identity of the natural person to whom a qualified certificate is to be issued. The provider may do this itself or through a third party. Either way the check must follow one of the methods in Article 24(1a).

There are four. The person can use a European Digital Identity Wallet or a notified electronic identification means at assurance level high. The person can use the certificate of an existing qualified signature. The check can be carried out in the person's physical presence. The fourth route is any other method that identifies the person with a high level of confidence, provided a conformity assessment body has confirmed that it does. A remote check of an identity document relies on this fourth route. Article 24(1c) gave the Commission until 21 May 2025 to list the reference standards for these checks.

This duty is the reason a qualified certificate can be relied on by a stranger. The counterparty who receives a signed contract was not present when the signer was identified. The certificate tells them that a supervised provider was, and names that provider. The reader can test that last point: the issuer should appear on the EU Trusted List with a granted qualified service for certificates for electronic signatures.

The provider that issued it revokes it, by registering the revocation in its certificate database and publishing the new status. Article 24(3) requires publication in a timely manner, and in any event within 24 hours after the provider receives the request. The revocation becomes effective immediately upon publication.

Revocation is final. Under Article 28(4), a qualified certificate that has been revoked after initial activation loses its validity from the moment of revocation, and its status cannot be reverted in any circumstances. A holder whose certificate was revoked by mistake needs a new certificate.

Suspension is a separate, temporary measure, and it exists only where a member state has laid down national rules for it. A suspended certificate loses its validity for the period of suspension. The period must be clearly indicated in the certificate database, and the status service must show the suspension while it lasts (Article 28(5)).

The regulation does not list the grounds for revocation. Each provider sets them out in its own terms and practice statements. Common ones are a lost phone or card, a suspicion that someone else has used the key, a change of name, or the holder's own request.

By asking the issuer's status service, which the certificate itself points to. Article 24(4) obliges every provider that issues qualified certificates to give any relying party information on their validity or revocation status. The information must be available for each certificate, at any time, in an automated manner that is reliable, efficient and free of charge. It must remain available beyond the certificate's validity period.

Few people query the service by hand. Signing and validation software does it, either by downloading the provider's list of revoked certificates or by asking about a single certificate in real time. The reader sees the outcome as a line in a validation report, such as the one produced by the European Commission's free signature validator.

The date that matters is the date of signing. One of the conditions for validating a qualified signature is that the qualified certificate was valid at the time of signing (Article 32(1)(b)). A signature made in March is not undone by a revocation in June. Expiry works the same way. Every certificate has an end date, and a signature made before it remains valid after it.

The reverse also holds. A signature made after revocation fails, however genuine it looks. Proving which came first is the job of a time stamp, which is why signatures that must last for years are time-stamped when they are made.

No. A qualified certificate is one of three ingredients of a qualified electronic signature. Article 3(12) defines that signature as an advanced electronic signature that is created by a qualified electronic signature creation device and is based on a qualified certificate. The certificate vouches for the signer's identity. The device protects the signer's key. The requirements for an advanced signature tie the signature to the signer and to the document.

A qualified certificate can therefore sit behind a signature that is not qualified. The regulation names this middle case, an advanced electronic signature based on a qualified certificate, and gives it its own validation rule in Article 32a. Such a signature has a verified identity behind it. It does not have the equivalent legal effect of a handwritten signature, which Article 25(2) gives to qualified electronic signatures only.

The distinction matters when a firm compares signing tools. A statement that a product "uses qualified certificates" does not say that its signatures are qualified. The follow-up question is where the signer's key is kept, and whether that place is a certified device.

Yes. Article 24a(3) requires a qualified certificate for electronic signatures provided in one member state to be recognised as a qualified certificate in all the others. Because Article 28(2) bars extra mandatory requirements, a receiving country cannot add conditions of its own.

Take a provider established in Portugal that issues a certificate to a signer who lives in Poland. A counterparty in Austria must treat that certificate as qualified, with no local registration and no second identity check. Whether the document in question needs a qualified signature at all is a different matter. Article 2(3) leaves national rules on the form of contracts untouched, so that question is answered by national law.