Glossary

The terms, with every acronym explained.

In alphabetical order.

1-QWAC: Model in which the website’s TLS certificate is itself the QWAC. Defined in ETSI TS 119 411-5. More.
2-QWAC: Model in which the QWAC is separate from the TLS certificate and bound to it by a JAdES signature. Defined in ETSI TS 119 411-5. More.
ACME: Protocol for issuing and renewing certificates automatically (RFC 8555). Used mainly for DV certificates.
Annex IV: Annex to eIDAS listing the mandatory content of a QWAC. Text.
CA/Browser Forum: Association of Certification Authorities and browser vendors that sets the rules for public TLS certificates (Baseline Requirements and EV Guidelines).
Certificate transparency (CT): Public logs where every public TLS certificate is published, so that any issuance can be audited.
Certification Authority (CA): Entity that issues digital certificates and signs them with its key.
clientAuth: Extended key usage that allows a certificate to authenticate a client in mutual TLS. Since June 2026 it can no longer appear in public TLS certificates.
CSR: Certificate signing request: a file with the public key and the holder’s details, generated with the private key and sent to the CA.
DV, OV, EV: Validation levels of TLS certificates: domain only (DV), also the organisation (OV), or extended validation of the organisation (EV). Compare.
eIDAS: Regulation (EU) No 910/2014 on electronic identification and trust services in the internal market. eidas.pt.
eIDAS 2: Common name for Regulation (EU) 2024/1183, which amended eIDAS, created the European Digital Identity Wallet and strengthened the QWAC regime.
ETSI: European Telecommunications Standards Institute. Publishes the technical standards for trust services (the 319 and 119 series).
EU trust mark: Logo that qualified providers may use to identify their qualified services (Article 23 of eIDAS). Not for certificate holders.
Implementing Regulation (EU) 2025/2527: Commission act of 16 December 2025 setting the reference standards for QWACs. Applies from 6 January 2027. More.
JAdES: ETSI advanced electronic signature format for JSON (TS 119 182-1). Used in the 2-QWAC binding.
mTLS: Mutual TLS: both parties to the connection present a certificate. Common in APIs, including PSD2 ones.
organizationIdentifier: Certificate field holding the organisation identifier, for example NTRPT- followed by the registration number, VATPT- followed by the VAT number, or PSDPT-BP- followed by the PSD2 authorisation number.
PSD2: Second Payment Services Directive, Directive (EU) 2015/2366. Opened account access to authorised third parties (open banking). PSD2 QWAC.
QcStatement: Qualified statement inside the certificate (ETSI EN 319 412-5), for example the one saying the certificate is qualified (QcCompliance) and the one saying it is for websites (QcType web).
QEVCP-w, QNCP-w, QNCP-w-gen: ETSI EN 319 411-2 certificate policies for QWACs: extended validation, normalised, and general purpose outside browser requirements.
QSealC: Qualified certificate for electronic seals. Under PSD2 it seals messages, alongside the QWAC, which protects the channel.
QTSP: Qualified Trust Service Provider. Only a QTSP can issue QWACs.
QWAC: Qualified Website Authentication Certificate. What it is.
Root programme: Each browser or operating system vendor’s policy defining which Certification Authorities it trusts and under which rules.
Supervisory body: National authority that supervises trust service providers. In Portugal, the Gabinete Nacional de Segurança (GNS).
Trusted list: Official list, kept by each Member State, of qualified providers and their services. The Commission publishes the list of lists (LOTL).

Request a quote

Need a QWAC?

Tell us what you need the QWAC for and which domains it should cover. We confirm whether you need a standard or a PSD2 QWAC, which documents are required, and reply on the same business day.

Prefer to talk? +351 210 205 164
business days, 9:00 to 18:00 Lisbon time

By email: support@sooma.com