Quovalis

What is a QWAC?

A QWAC — Qualified Website Authentication Certificate — is a TLS certificate whose issuer and issuance rules are regulated under the EU's eIDAS framework (Regulation (EU) No 910/2014, Article 45 and Annex IV). Technically it is an ordinary X.509 certificate; what makes it qualified is who issued it and under what regime.

What “qualified” adds over plain TLS

Any CA can vouch for control of a domain name. A QWAC additionally binds the site to a vetted legal entity, and the vetting itself is regulated:

  • The issuer must be a qualified trust service provider (QTSP) — a CA whose qualified status has been granted under the supervision regime of an EU/EEA Member State and published on that state's trusted list.
  • Issuance follows the certificate policies standardised for qualified website certificates (ETSI EN 319 411-2), which require verified identity attributes of the subscribing legal entity in the certificate subject — not just domain control.
  • Whether a given certificate actually counts as qualified is decided by the trusted list, not by the certificate itself — see how qualified status is determined.

Who issues QWACs

QTSPs whose certificate-issuing services appear on a national trusted list with the service type CA/QC and a granted status. Every EU/EEA member state publishes its own list, and the European Commission's List of Trusted Lists (LOTL) points at all of them. You can browse the providers the current lists contain through the API: GET /v1/trustlist/providers (see the quickstart).

What a QWAC looks like on the wire

A QWAC is served in the TLS handshake like any other certificate. Three things distinguish it when you parse it:

  • Subject identity attributes: the legal entity's name and, where applicable, a registered organizationIdentifier (for PSD2 certificates this carries the authorization number, e.g. PSDNL-DNB-123456).
  • The qcStatements extension (ETSI EN 319 412-5): a QcCompliance statement claiming the certificate is an EU qualified certificate, and a QcType of id-etsi-qct-web (OID 0.4.0.1862.1.6.3) marking it as a website authentication certificate. PSD2 certificates add the payment statement from ETSI TS 119 495 (roles and the competent authority).
  • A qualified certificate policy identifier from ETSI EN 319 411-2.

These fields are the issuer's claim. Confirming the claim means resolving the issuing CA on the trusted lists — a browser does not do this for you: today's mainstream browsers neither require nor display qualified status, so a padlock says nothing about whether a certificate is a QWAC. That check remains the relying party's job — it is the check a validation API automates (see the Terms for the documented non-claims).

Validating a QWAC

POST the PEM certificate to /v1/validations under POLICY_EIDAS_QWAC_V1 and read the result — chain building to a trusted-list anchor, qualified-status mapping, revocation checking and qcStatements parsing in one call:

// Excerpt of a validation response for a QWAC
// (POST /v1/validations, policy POLICY_EIDAS_QWAC_V1)
{
  "verdict": "VERDICT_VALID",
  "certificate": {
    "subject": "CN=bank.example.com,O=Example Bank N.V.,organizationIdentifier=PSDNL-DNB-123456,C=NL",
    …
  },
  "qualified": {
    "isQualified": true,
    "qcType": "QC_TYPE_WEB",
    "trustServiceProvider": { "name": "Example QTSP", "territory": "NL", "serviceStatus": "granted", … },
    …
  },
  …
}

Verdicts are tri-state (VERDICT_VALID, VERDICT_INVALID, VERDICT_INDETERMINATE); a result the service cannot establish from published trust-list and revocation data is reported indeterminate, never rounded up. The full request and response walk-through is in the API quickstart.

Related