Getting started with eIDAS certificates

Certificate request workflow

The end-to-end process for ordering and receiving an eIDAS certificate is as follows:

  1. Generate your signing key pair and CSR (if required).

  2. Place your order using one of the available API endpoints.

  3. Provide required details such as:

    • Organization information

    • Domain(s) (for QWACs)

    • Contact details

  4. Complete the required validation steps.

    The certificate is issued once all validation steps are completed.

  5. If delivered on a QSCD, follow the provided instructions (in the email) to access your certificate.

  6. Install and use the certificate as needed.

Track your order status

You can track the order status using the GetDetailedOrderStatus or getPostPaymentStatus API endpoints. The order status is updated as the order progresses through the validation and issuance process.

Possible order statuses include:

  • Current

  • Awaiting payment

  • Payment promised

  • Pending

  • Awaiting authorization

  • Processed

  • Rejected

  • Refunded

Validation and requirements

To issue eIDAS qualified certificates, whether to individuals (natural persons) or organizations (legal persons), Sectigo must validate the identity of the person and/or the organization for which the certificate will be issued.

To finalize your eIDAS request, certain validation steps must be completed before Sectigo can issue your certificate. These steps vary depending on the certificate type, delivery method, and regulatory requirements, and can include the following:

  • Submitting your CSR — A CSR is required whenever the key pair is generated by the requester. This applies to Qualified Website Authentication Certificates (QWACs) and any certificates where the keys are generated on your own infrastructure rather than a Sectigo-provided secure device.

  • Domain control validation — For QWACs only, you must prove that you control the domain(s).

  • Face-to-face verification — You must provide proof of identity.

  • Email verification — You must verify ownership of the email address used for the order.

  • Agreement execution — You must accept the Subscriber Agreement before validation can begin.

  • Signer verification — For orders made on behalf of an organization, you must prove you are an authorized representative.

  • Organization validation — Sectigo verifies the physical, legal, and operational existence of organizations.

  • Second approval — An additional validation step performed by Sectigo for QWAC orders during the issuance process.

Validation requirements by certificate type

Qualified certificates

The following table summarizes the steps required for qualified certificates for citizen, employee, and seal, where:

  • Y — Yes, the step is required for that certificate type.

  • N — No, the step is not required for that certificate type.

  • N/A — Not applicable for that certificate type.

QSCD means qualified electronic signature creation device.
Validation step Citizen Qualified Certificate Employee Qualified Certificate Seal Qualified Certificate

Subscriber agreement

Y

Y

Y

Email verification

Y

Y

Y

CSR

N (Y if for non-QSCD)

N (Y if for non-QSCD)

N (Y if for non-QSCD)

Face-to-face verification

Y

Y

Y

Signer verification

N

Y

Y

Organization validation

N

Y

Y

NCA information

N/A

N/A

PSD2 only

Qualified Website Authentication Certificates (QWACs)

The following table summarizes the steps required for QWACs where:

  • Y — Yes, the step is required for that certificate type.

  • N — No, the step is not required for that certificate type.

  • N/A — Not applicable for that certificate type.

Validation step QWAC Legal PSD2 QWAC

Subscriber agreement

Y

Y

CSR

Y

Y

Face-to-face verification

Y

Y

Domain control validation

Y

Y

Signer verification

Y

Y

Organization validation

Y

Y

Second approval

Y

Y

NCA information

N/A

Y

PSD2 role

N/A

At least one required
PSD2 QWACs are intended exclusively for identification and authentication in PSD2/Open Banking API communications between regulated payment service providers. They can only be issued to legal entities and require NCA information and at least one PSD2 role.

Qualified certificates for natural persons

The processes for natural persons ordering qualified certificates as either a citizen or an employee of an organization are similar, with employees providing additional details about their organization.

In both cases, the identity of a natural person and, if applicable, any specific attributes of the person must be verified.

Evidence must be provided of the following:

  • Full name (surname and given names)

  • Date and place of birth, or other identifying attributes

Certificate signing request (CSR)

Before requesting an eIDAS certificate, you may need to generate a Certificate Signing Request (CSR).

A CSR contains:

  • The public key

  • Subject information such as organization or domain

A CSR is required when the key pair is generated by you rather than issued on a Sectigo-provided device.

The CSR is in a standardized format (PKCS#10) used to request certificates from a certificate authority.

For more information about CSR generation, see Certificate Signing Request.

QWACs can include multiple domains using Subject Alternative Names (SAN), provided all domains are successfully validated.

Certificate delivery and key storage

Depending on the certificate type and configuration, eIDAS certificates are delivered in different ways:

  • Sectigo-provisioned certificates — The secure creation device (SCD) or qualified signature creation device (QSCD), such as a USB eToken, is initialised and shipped by Sectigo. The private key is generated and stored on the device by Sectigo.

  • Remotely provisioned certificates — Certificates are issued based on a customer-generated CSR, where the key pair is generated and managed by the customer. Private keys may be stored in environments such as:

  • USB eTokens (QSCD or SCD)

  • Hardware security modules (HSM)

  • Smart cards

  • Secure key vault services

For device-based certificates, the hardware token and access credentials (PIN or password) are delivered separately for added security.

Signature creation devices

eIDAS certificates can be used with secure devices known as signature creation devices (SCDs), which protect the private key used for signing or sealing.

A qualified signature creation device (QSCD) is a certified SCD that meets additional regulatory requirements.

Qualified electronic signatures (QES) can only be created using a certificate stored on a QSCD.

The type of device used determines whether the resulting electronic signature or seal is advanced or qualified.

To use these certificates, you must have access to the device and authenticate using a PIN or password.