The legal definition
The eIDAS Regulation defines two nested concepts. First, the certificate for website authentication in general:
‘Certificate for website authentication’ means an electronic attestation that makes it possible to authenticate a website and links the website to the natural or legal person to whom the certificate is issued.
Then the qualified version: a certificate for website authentication that is issued by a qualified trust service provider and meets the requirements laid down in Annex IV (Article 3, point 39). Both conditions must be met at once. A certificate with all the right fields, issued by someone without qualified status, is not a QWAC; and qualified providers also issue certificates that are not qualified.
In practice, almost every SSL/TLS certificate protecting a website already does what point 38 describes: it authenticates the site. What sets a QWAC apart is point 39: the issuer is supervised under eIDAS, the attested identity was verified under qualified rules, and the certificate states, in machine-readable form, that it is qualified.
What a QWAC must contain
Annex IV of eIDAS, as amended in 2024, lists the mandatory data:
- An indication, at least in a form suitable for automated processing, that the certificate has been issued as a qualified certificate for website authentication.
- Data unambiguously representing the issuing qualified provider, including the Member State in which it is established.
- For natural persons: the name, or a pseudonym clearly indicated as such.
- For legal persons: a unique set of data representing the entity, with at least its name and, where applicable, its registration number as stated in official records.
- Elements of the holder’s address, including at least city and State.
- The domain name or names operated by the holder.
- The start and end of the validity period.
- The certificate identity code, unique for the provider.
- The provider’s advanced electronic signature or seal.
- Where the certificate supporting that signature or seal is available free of charge.
- Where to find the services that confirm the certificate’s validity status (for example OCSP or revocation lists).
In the certificate’s technical structure, the “indication that it is qualified” takes the form of dedicated statements, the QcStatements defined in ETSI EN 319 412-5: one saying the certificate is qualified (QcCompliance) and another saying what it is for (QcType = web). The organisation’s identity goes in the usual subject fields, with the registration number in a dedicated field (organizationIdentifier). The details are in How it works.
Who may issue a QWAC
Only a qualified trust service provider (QTSP) that has qualified status for issuing QWACs. To hold that status, the provider:
- is audited by an accredited conformity assessment body before starting and then at least every 24 months;
- is supervised by the supervisory body of the Member State in which it is established (in Portugal, the Gabinete Nacional de Segurança);
- appears on that Member State’s trusted list, with its QWAC service marked as qualified.
National lists are brought together by the European Commission in a list of lists, which can be searched in the EU trusted list browser. That is where you can confirm whether a provider is currently authorised to issue QWACs.
Since eIDAS 2, Article 24a(7) states expressly that a QWAC issued in one Member State is recognised as a QWAC in all other Member States. A Portuguese company can use a QWAC from an Italian or Polish provider with exactly the same effect.
What a QWAC guarantees, and what it does not
It guarantees that, at the time of issue, a qualified provider verified that the domain is controlled by the holder and that the holder exists and is who it claims to be, with the registration data shown in the certificate. It also guarantees that the provider is liable for that verification under eIDAS, which sets out the liability of providers for damage caused by failure to comply.
It does not guarantee that the website is honest, secure or free of flaws. Nor does it guarantee, by itself, that visitors will see the identity: that depends on the browser. Today, Firefox shows it; most browsers do not yet. See Browser support.
How to check whether a website has a QWAC
- In Firefox 153 or later: click the padlock in the address bar. On a site with a QWAC, the panel shows the organisation, the provider that verified it and the statement that the certificate is qualified under eIDAS.
- In any browser: open the certificate details and look, among the extensions, for the qualified statements (qcStatements) and an ETSI certificate policy starting with
0.4.0.194112.1. - From the command line:
openssl s_client -connect company.eu:443 -servername company.eu </dev/null 2>/dev/null \
| openssl x509 -noout -text \
| grep -A3 -E "Certificate Policies|qcStatements|1\.3\.6\.1\.5\.5\.7\.1\.3"To confirm that the issuer really has qualified status, look it up in the trusted list browser. DigitalTrust has free tools to check and decode certificates.
QWAC, QCert for WA, qualified website certificate
They all mean the same thing. EU documentation uses QWAC, QCert for WA (on the trusted lists) and qualified certificate for website authentication. In Portuguese, the official text says «certificado qualificado de autenticação de sítios Web». Outside the EU, the closest equivalent is the EV certificate, which verifies the organisation but has no legal status.