Qualified Website Authentication Certificate
Accredited conformity assessment of qualified website authentication certificate services under the eIDAS Regulation and applicable ETSI standards.
Who needs this — and why
Issuing qualified website authentication certificates is itself a regulated trust service: before certificates can be issued as qualified, the service behind them is assessed by an accredited body under eIDAS.
Qualified website authentication certificates allow websites to prove their identity and establish trusted communication with users. They are used by qualified trust service providers delivering authenticated web services where organisational identity must be independently verified.
Because trust depends on more than certificate issuance, the assessment covers identity verification, certificate lifecycle management and the operational controls supporting the service throughout its operation.
Every trust service differs in architecture, certification practices and operational model. The assessment therefore begins by defining the appropriate scope.
Trusted website authentication
Qualified website authentication relies on robust certificate management, trusted identity verification and secure operational processes. Our auditors combine accredited assessment with practical security expertise to verify that the service consistently satisfies the requirements for qualified website authentication.
What the certification covers
Our assessment covers the complete lifecycle of a qualified website authentication certificate service, from identity verification and certificate issuance to certificate management, revocation and ongoing operation. We examine how applicant organisations are validated, how qualified certificates are issued and protected, and how the service maintains trust throughout the certificate lifecycle.
The assessment also includes the wider governance and security framework supporting the service, including certification practices, operational procedures, incident management, cryptographic controls and change management. Rather than reviewing individual controls in isolation, we evaluate how the service functions as a whole and whether objective evidence demonstrates that technical and organisational controls operate consistently in practice.
Standards & articles
Qualified website authentication certificate services are assessed against the applicable requirements of the eIDAS Regulation and its supporting ETSI standards.
This may include:
- Regulation (EU) No 910/2014 (Article 45)
- ETSI EN 319 411-2
- ETSI EN 319 401
- Applicable supervisory requirements
The exact assessment scope depends on the qualified trust service provided and is agreed with you during scoping, before the assessment begins.
Where we've done it
Our experience includes accredited assessments involving organisations such as those below — the full list is available on our references page.
-
Incode
-
MISA
-
monobank
-
Scrive
More broadly, TAYLLORCOX has certified more than 30 trust services across 11 countries.
Our references include qualified trust service providers delivering website authentication services across Europe and international markets.
Explore the full eIDAS scope
We assess every trust service and identity scheme the Regulation defines — not only the one on this page.
Request an assessment
If you are launching a qualified website authentication certificate service, preparing for supervisory assessment or reviewing an existing qualified service, we can help define the assessment scope and explain what evidence will be required before the conformity assessment begins.
Your first conversation will be with an experienced eIDAS auditor who will discuss your service, applicable standards and the most appropriate assessment path.
