Straight answers about QWACs.

A qualified certificate for website authentication, defined in the European eIDAS Regulation. It binds a domain to a person or entity whose identity has been verified by a qualified trust service provider supervised by a national authority. Learn more.

Yes, in the most common model (1-QWAC). The QWAC is itself a complete TLS certificate: it encrypts the connection like any other and adds the qualified identity. You do not need two certificates.

Yes. A 1-QWAC is issued by a Certification Authority that browsers accept, so it works in Chrome, Safari, Edge, Firefox and the rest. The difference is that, for now, only Firefox (since version 153) and Opera for Android display the qualified identity.

It depends on why you need it. If you need it by law (PSD2) or for machine-to-machine integrations, browser display is irrelevant. If the goal is visitor trust, Firefox already shows it and eIDAS 2 obliges the others; the technical standards apply from 6 January 2027.

Yes. Article 45(1a) of eIDAS, as amended by Regulation (EU) 2024/1183, requires browser providers to recognise QWACs and display the attested identity in a user-friendly manner. Micro and small enterprises are exempt during their first five years as browser providers.

In a 1-QWAC, the website’s TLS certificate is the QWAC itself. In a 2-QWAC, the site uses an ordinary TLS certificate plus a separate QWAC, bound to it by a JAdES signature announced in an HTTP header. Both are defined in ETSI TS 119 411-5. See the details.

Only qualified trust service providers listed on the EU trusted lists with an active QWAC service. Sooma is not a qualified provider: the QWACs we provide are issued by European qualified providers.

Yes. Article 24a(7) of eIDAS states that a QWAC issued in one Member State is recognised as a QWAC in all the others.

A 1-QWAC follows the rules for public TLS certificates: at most 200 days since 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. That is why we sell 1- to 5-year subscriptions with reissues included.

At DigitalTrust, €250 a year for one domain and €425 a year for up to 5 domains; a PSD2 QWAC costs €350 a year, or €500 for up to 10 domains. Prices exclude VAT, with 15 to 25% off for 2 to 5 years. Full price table.

Usually 3 to 7 business days once the documents are in. Reissues during the subscription are faster while the organisation validation can still be reused.

A company registry extract, identification of the legal representative and, where applicable, a power of attorney. For a PSD2 QWAC, also the authorisation number from the competent authority and the authorised PSD2 roles.

eIDAS allows QWACs for natural persons, with a name or a pseudonym. In practice, providers issue them mainly to legal persons, and that is where a QWAC makes sense.

EV rules do not allow wildcards, and 1-QWACs are usually issued with extended validation. For several subdomains, use a multi-domain QWAC listing each name.

Yes, in the PSD2 QWAC version, which includes the authorised roles and the competent authority, under ETSI TS 119 495. Delegated Regulation (EU) 2018/389 requires QWACs or QSealCs from payment service providers. PSD2 QWAC.

Since 15 June 2026, public TLS certificates can no longer include the client authentication usage, as required by the Chrome root programme. For mutual TLS, particularly under PSD2, use a QWAC issued from a dedicated hierarchy outside browsers. See what changed.

No. The EU trust mark for qualified trust services is for qualified providers to identify the services they provide (Article 23 of eIDAS), not for certificate holders.

Encryption is the same as with any TLS certificate. What a QWAC adds is qualified proof of who the holder is, which helps against impersonation and phishing when the browser shows it, and which is required in certain legal contexts.

In Firefox 153 or later, click the padlock. In any browser, open the certificate details and look for the qualified statements (qcStatements) and an ETSI policy starting with 0.4.0.194112.1. How to check.

The reference standards of Implementing Regulation (EU) 2025/2527 start to apply: ETSI EN 319 411-2 or TS 119 495 for QWACs used outside the browser, and ETSI TS 119 411-5 for the others, including in the browser. Qualified providers must be audited against those standards.