This field is REQUIRED and SHALL comply with clause 5.2.1 of ETSI TS 102 231.

F3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

This field is REQUIRED and SHALL be set to ‘3’ (integer).

F1This field is REQUIRED. It SHALL specify the sequence number of the TSL. Starting from ‘1’ at the first release of the TSL, this integer value SHALL be incremented at each subsequent release of the TSL. It SHALL NOT be recycled to ‘1’ when the ‘TSL version identifier’ above is incremented.

This field is REQUIRED. It SHALL specify the address of the legal entity or mandated organization identified in the ‘Scheme operator name’ field (clause 5.3.4) for both postal and electronic communications. It SHALL include both ‘PostalAddress’ (i.e. street address, locality, [state or province], [postal code] and ISO 3166-1 alpha-2 country code) as compliant with clause 5.3.5.1; and ‘ElectronicAddress’ (i.e. e-mail and/or website URI) as compliant with clause 5.3.5.2.

This field is REQUIRED specifying the name under which the scheme operates. It SHALL be a sequence of multilingual character strings (with EN as the mandatory language, and with potentially one or more national languages) defined as follows:

• The EN version SHALL be a character string structured as follows:

  CC:EN_name_value

  where

  — ‘CC’

  the ISO 3166-1 alpha-2 Country Code used in the ‘Scheme territory field’ (clause 5.3.10);

  — ‘:’

  is used as the separator;

  F1— ‘EN_name_value’

  Supervision/Accreditation Status List of certification services from Certification Service Providers, which are supervised/accredited by the referenced Member State for compliance with the relevant provisions laid down in Directive 1999/93/EC and its implementation in the referenced Member State’s laws;

• Any Member State’s national language version SHALL be a character string structured as follows:

  CC:name_value

  where

  — ‘CC’

  the ISO 3166-1 alpha-2 Country Code used in the ‘Scheme territory field’ (clause 5.3.10);

  — ‘:’

  is used as the separator;

  — ‘name_value’

  National language official translation of the above EN_name_value.

The scheme name is required to uniquely identify, by name, the scheme referred to by the Scheme information URI, and also to ensure that in case a scheme operator operates more than one scheme, there is a distinct name given to each of them.

Member States and Scheme operators SHALL make sure that when a Member State or a Scheme Operator operates more than one scheme, there is a distinct name given to each of them.

This field is REQUIRED and SHALL specify the URI(s) where users (relying parties) can obtain scheme-specific information (with EN as the mandatory language and with potentially one or more national languages). This SHALL be a sequence of multilingual pointers (with EN as the mandatory language, and with potentially one or more national languages). The referenced URI(s) MUST provide a path to information describing ‘appropriate information about the scheme’.

The appropriate information about the scheme SHALL include as a minimum:

• General introductory information that would be common to all Member States with regard to the scope and context of the Trusted List, and the underlying supervision/accreditation scheme(s). The common text to be used is as follows:

  The present list is the TSL implementation of [name of the relevant Member State] “Trusted List of supervised/accredited Certification Service Providers” providing information about the supervision/accreditation status of certification services from Certification Service Providers (CSPs) who are supervised/accredited by [name of the relevant Member State] for compliance with the relevant provisions of Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a Community framework for electronic signatures.

  The Trusted List aims at:

  • listing and providing reliable information on the supervision/accreditation status of certification services from Certification Service Providers, who are supervised/accredited by [name of the relevant Member State] for compliance with the relevant provisions laid down in Directive 1999/93/EC;

  • facilitating the validation of electronic signatures supported by those listed supervised/accredited certification services from the listed CSPs.

  The Trusted List of a Member State provides a minimum of information on supervised/accredited CSPs issuing Qualified Certificates in accordance with the provisions laid down in Directive 1999/93/EC (Art. 3,3, 3.2 and Art. 7.1(a)), including information on the QC supporting the electronic signature and whether the signature is or not created by a Secure Signature Creation Device.

  The CSPs issuing Qualified Certificates (QCs) listed here are supervised by [name of the relevant Member State] and may also be accredited for compliance with the provisions laid down in Directive 1999/93/EC, including with the requirements of Annex I (requirements for QCs), and those of Annex II (requirements for CSPs issuing QCs). The applicable “supervision” system (respectively “voluntary accreditation” system) is defined and must meet the relevant requirements of Directive 1999/93/EC, in particular those laid down in Art. 3,3, Art. 8,1, Art. 11 (respectively, Art. 2,13, Art. 3,2, Art 7.1(a), Art. 8,1, Art. 11)

  Additional information on other supervised/accredited CSPs not issuing QCs but providing services related to electronic signatures (e.g. CSP providing Time Stamping Services and issuing Time Stamp Tokens, CSP issuing non-Qualified certificates, etc.) are included in the Trusted List and the present TSL implementation at a national level on a voluntary basis.

• Specific information on the underlying supervision/accreditation scheme(s), in particular21:

  • Information on the supervision system applicable to any CSP_QC;

  • Information, when applicable, on the national voluntary accreditation scheme applicable to any CSP_QC;

  • Information, when applicable, on the supervision system applicable to any CSP not issuing QCs;

  • Information, when applicable, on the national voluntary accreditation scheme applicable to any CSP not issuing QCs;

• This specific information SHALL include, at least, for each underlying scheme listed above:

  • General description;

  • Information about the process followed by the Supervisory/Accreditation Body to supervise/accredit CSPs and by the CSPs for being supervised/accredited;

  • Information about the criteria against which CSPs are supervised/accredited.

• Specific information, when applicable, on the specific qualifications some of the physical or binary (logical) objects generated or issued as a result of the provision of a certification service may be entitled to receive on the basis of their compliance with the provisions and requirements laid down at national level including the meaning of such a qualification and the associated national provisions and requirements.

Additional Member State specific information about the scheme MAY additionally be provided on a voluntary basis. This SHALL include:

• Information about the criteria and rules used to select supervisors/auditors and defining how CSPs are supervised (controlled)/accredited (audited) by them;

• Other contact and general information that applies to the scheme operation.

This field is REQUIRED and SHALL specify the identifier of the status determination approach. The following specific URI SHALL be used, as registered and described as follows:

URI

http://uri.etsi.org/TrstSvc/eSigDir-1999-93-EC-TrustedList/StatusDetn/appropriate

Description

Services listed have their status determined by or on behalf of the Scheme Operator under an appropriate system for a referenced Member State that allows for ‘supervision’ (and, when applicable, for ‘voluntary accreditation’) of certification service providers who are established on its territory (or established in a third country in the case of ‘voluntary accreditation’) and issue qualified certificates to the public according to Art. 3,3 (respectively Art. 3,2 or Art. 7.1(a)) of the Directive 1999/93/EC, and, when applicable, that allows for the ‘supervision’/‘voluntary accreditation’ of certification service providers not issuing qualified certificates, according to a nationally defined and established recognised ‘approval scheme(s)’ implemented on a national basis for the supervision of compliance of services from CSPs not issuing QCs with the provisions laid down in Directive 1999/93/EC and potentially extended by national provisions with regard to the provision of such certification services.

This field is REQUIRED and SHALL contain at least the following registered URIs:

• A URI common to all Member States' Trusted Lists pointing towards a descriptive text that SHALL be applicable to all TLs:

  http://uri.etsi.org/TrstSvc/eSigDir-1999-93-EC-TrustedList/schemerules/common

  • By which participation is denoted of the Member State’s scheme (identified via the TSL type (clause 5.3,3) and Scheme name (clause 5.3.6)) in a scheme of schemes (i.e. a TSL listing pointers to all Member States publishing and maintaining a TL in the form of a TSL);

  • Where users can obtain policy/rules against which services included in the list SHALL be assessed and from which the type of the TSL (see clause 5.3.3) can be determined;

  • Where users can obtain description about how to use and interpret the content of the TSL implementation of the Trusted List. These usage rules SHALL be common to all Member States' Trusted Lists whatever the type of listed service and whatever the supervision/accreditation system(s) is (are).

  Descriptive text:

  Participation in a scheme

  Each Member State must create a “Trusted List of supervised/accredited Certification Service Providers” providing information about the supervision/accreditation status of certification services from Certification Service Providers (CSPs) who are supervised/accredited by the relevant Member State for compliance with the relevant provisions of Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a Community framework for electronic signatures.

  The present TSL implementation of such Trusted Lists is also to be referred to in the list of links (pointers) towards each Member State’s TSL implementation of their Trusted List, compiled by the European Commission.

  Policy/rules for the assessment of the listed services

  The Trusted List of a Member State must provide a minimum of information on supervised/accredited CSPs issuing Qualified Certificates in accordance with the provisions laid down in Directive 1999/93/EC (Art. 3.3, 3,2 and Art. 7.1(a)), including information on the Qualified Certificate (QC) supporting the electronic signature and whether the signature is or not created by a Secure Signature Creation Device.

  The CSPs issuing Qualified Certificates (QCs) must be supervised by the Member State in which they are established (if they are established in a Member State), and may also be accredited, for compliance with the provisions laid down in Directive 1999/93/EC, including with the requirements of Annex I (requirements for QCs), and those of Annex II (requirements for CSPs issuing QCs). CSPs issuing QCs that are accredited in a Member State must still fall under the appropriate supervision system of that Member State unless they are not established in that Member State. The applicable “supervision” system (respectively “voluntary accreditation” system) is defined and must meet the relevant requirements of Directive 1999/93/EC, in particular those laid down in Art. 3,3, Art. 8,1, Art. 11 (respectively, Art.2.13, Art. 3,2, Art 7.1(a), Art. 8,1, Art. 11).

  Additional information on other supervised/accredited CSPs not issuing QCs but providing services related to electronic signatures (e.g. CSP providing Time Stamping Services and issuing Time Stamp Tokens, CSP issuing non-Qualified certificates, etc.) may be included in the Trusted List and the present TSL implementation at a national level on a voluntary basis.

  CSPs not issuing QCs but providing ancillary services, may fall under a “voluntary accreditation” system (as defined in and in compliance with Directive 1999/93/EC) and/or under a nationally defined “recognised approval scheme” implemented on a national basis for the supervision of compliance with the provisions laid down in Directive 1999/93/EC and possibly with national provisions with regard to the provision of certification services (in the sense of Art. 2,11 of the Directive). Some of the physical or binary (logical) objects generated or issued as a result of the provision of a certification service may be entitled to receive a specific “qualification” on the basis of their compliance with the provisions and requirements laid down at national level but the meaning of such a “qualification” is likely to be limited solely to the national level.

  Interpretation of the TSL implementation of the Trusted List

  The general user guidelines for electronic signature applications, services or products relying on a TSL implementation of a Trusted List according to the Annex of Commission Decision 2009/767/EC are as follows:

  A “CA/QC”“Service type identifier” (Sti) entry (similarly a CA/QC entry further qualified as being a “RootCA/QC” through the use of “Service information extension” (Sie) additionalServiceInformation extension)

  • indicates that from the “Service digital identifier” (Sdi) identified CA (similarly within the CA hierarchy starting from the “Sdi” identified RootCA) from the corresponding CSP (see associated TSP information fields), all issued end-entity certificates are Qualified Certificates (QCs) provided that it is claimed as such in the certificate through the use of appropriate ETSI TS 101 862 defined QcStatements (i.e. QcC, QcSSCD) and/or ETSI TS 101 456 defined QCP(+) OIDs (and this is guaranteed by the issuing CSP and ensured by the Member State Supervisory/Accreditation Body)

    Note: if no “Sie”“Qualification” information is present or if an end-entity certificate that is claimed to be a QC is not “further identified” through a related Sie entry, then the “machine-processable” information to be found in the QC is supervised/accredited to be accurate. That means that the usage (or not) of the appropriate ETSI defined QcStatements (i.e. QcC, QcSSCD) and/or ETSI defined QCP(+) OIDs is ensured to be in accordance with what it is claimed by the CSP issuing QCs.

  • and IF“Sie”“Qualification” information is present, then in addition to the above default usage interpretation rule, those certificates that are identified through the use of this Sie Qualification entry, which is constructed on the principle of a sequence of “filters” further identifying a set of certificates, must be considered according to the associated qualifiers providing some additional information regarding SSCD support and/or “Legal person as subject” (e.g. those certificates containing a specific OID in the Certificate Policy extension, and/or having a specific “Key usage” pattern, and/or filtered through the use of a specific value to appear in one specific certificate field or extension, etc.). Those qualifiers are part of the following set of “qualifiers” used to compensate for the lack of information in the corresponding QC content, and that are used respectively:

    • to indicate the nature of the SSCD support:

      • “QCWithSSCD” qualifier value meaning “QC supported by an SSCD”, or

      • “QCNoSSCD” qualifier value meaning “QC not supported by an SSCD”, or

      • “QCSSCDStatusAsInCert” qualifier value meaning that the SSCD support information is ensured to be contained in any QC under the “Sdi”-“Sie” provided information in this CA/QC entry;

      AND/OR

    • to indicate issuance to Legal Person:

      • “QCForLegalPerson” qualifier value meaning “Certificate issued to a Legal Person”

  The general interpretation rule for any other “Sti” type entry is that the listed service named according to the “Sn” field value and uniquely identified by the “Sdi” field value has a current supervision/accreditation status according to the “Scs” field value as from the date indicated in the “Current status starting date and time”. Specific interpretation rules for any additional information with regard to a listed service (e.g. “Service information extensions” field) may be found, when applicable, in the Member State specific URI as part of the present “Scheme type/community/rules” field.

  Please refer to the Technical specifications for a Common Template for the “Trusted List of supervised/accredited Certification Service Providers” in the Annex of Commission Decision 2009/767/EC for further details on the fields, description and meaning for the TSL implementation of the Member States' Trusted Lists.

• A URI specific to each Member State’s Trusted List pointing towards a descriptive text that SHALL be applicable to this Member State TL:

  http://uri.etsi.org/TrstSvc/eSigDir-1999-93-EC-TrustedList/schemerules/CC

  where CC = the ISO 3166-1 alpha-2 Country Code used in the ‘Scheme territory’ field (clause 5.3.10)

  • Where users can obtain the referenced Member State’s specific policy/rules against which services included in the list SHALL be assessed in compliance with the Member State’s appropriate supervision system and voluntary accreditation schemes.

  • Where users can obtain a referenced Member State’s specific description about how to use and interpret the content of the TSL implementation of the Trusted List with regard to the certification services not related to the issuing of QCs. This may be used to indicate a potential granularity in the national supervision/accreditation systems related to CSPs not issuing QCs and how the ‘Scheme service definition URI’ (clause 5.5.6) and the ‘Service information extension’ field are used for this purpose.

  Member States MAY define additional URIs from the above Member State specific URI (i.e. URIs defined from this hierarchical specific URI).

In the context of the present specifications, this field is REQUIRED and SHALL specify the country in which the scheme is established (ISO 3166-1 alpha-2 country code).

In the context of the present specifications, this field is REQUIRED and SHALL specify the scheme’s policy or provide a notice concerning the legal status of the scheme or legal requirements met by the scheme for the jurisdiction in which the scheme is established and/or any constraints and conditions under which the TL is maintained and published.

This SHALL be a multilingual character string (plain text) made of two parts:

• A first mandatory part, common to all Member States' TLs (with EN as the mandatory language, and with potentially one or more national languages), indicating that the applicable legal framework is Directive 1999/93/EC and its corresponding implementation in the laws of the Member State indicated in the ‘Scheme Territory’ field.

  English version of the common text:

  The applicable legal framework for the present TSL implementation of the Trusted List of supervised/accredited Certification Service Providers for [name of the relevant Member State] is the Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a Community framework for electronic signatures and its implementation in [name of the relevant Member State] laws.

  Text in a Member State’s national language(s): [official translation(s) of the above English text].

• A second optional part, specific to each TL (with EN as the mandatory language, and with potentially one or more national languages), indicating references to specific applicable national legal frameworks (e.g. in particular when related to national supervision/accreditation schemes for CSPs not issuing QCs).

This field is REQUIRED and SHALL specify the duration (integer) over which historical information in the TSL is provided. This integer value is to be provided in number of days and in the context of the present specifications it SHALL be greater or equal to 3 653 (i.e. meaning that the TSL implementation of Member States' TL MUST contain historical information for a minimum of ten years). Greater values should take due account of the legal requirements for data retention in the Member State indicated in the ‘Scheme Territory’ (clause 5.3.10).

This field is REQUIRED and SHALL specify the date and time (UTC expressed as Zulu) on which the TSL was issued using Date-time value as specified in ETSI TS 102 231, clause 5.1.4.

This field is REQUIRED and SHALL specify the latest date and time (UTC expressed as Zulu) by which the next TSL will be issued or be null to indicate a closed TSL (using Date-time value as specified in ETSI TS 102 231, clause 5.1.4).

In the event of no interim status changes to any TSP or service covered by the scheme, the TSL MUST be re-issued by the time of expiration of the last TSL issued.

In the context of the present specifications, the difference between the ‘Next update’ date and time and the ‘List issue date and time’ SHALL NOT exceed six (6) months.

This field is OPTIONAL. If used, it SHALL specify locations where the current TSL implementation of the TL is published and where updates to the current TSL can be found. If multiple distribution points are specified, they all MUST provide identical copies of the current TSL or its updated version. When used, this field is formatted as non-empty sequence of strings, each of them compliant with RFC 398624.

This field is OPTIONAL and is not used in the context of the present specification.

This field is REQUIRED and SHALL specify the identifier of the service type, with the format and meaning used in ‘TSP Service Information — Service type identifier’ (clause 5.5.1).

This field is REQUIRED and SHALL specify the name under which the CSP provided the service identified in ‘TSP Service Information — Service type identifier’ (clause 5.5.1), with the format and meaning used in ‘TSP Service Information — Service name’ (clause 5.5.2). This clause does not require that the name be the same as that specified in clause 5.5.2. A change of name MAY be one of the circumstances requiring a new status.

This field is REQUIRED and SHALL specify the identifier of the previous status of the service, with the format and meaning used in ‘TSP Service Information — Service current status’ (clause 5.5.4).

This field is REQUIRED and SHALL specify the date and time on which the previous status in question became effective, with the format and meaning used in ‘TSP Service Information — Service current status starting date and time’ (clause 5.5.5).

This field is OPTIONAL and MAY be used by scheme operators to provide specific service-related information with the format and meaning used in ‘TSP Service Information — Service information extensions’ (clause 5.5.9).

Idem for TSP(1) Service 2 (as applicable)

TSP(1)Service(2)History(1)

…

Idem for TSP 2 (as applicable)

Idem for TSP 2 Service 1

Idem for TSP 2 Service 1 History 1

…

This extension is OPTIONAL. When used it MUST comply to the specifications of ETSI TS 102 231, clause 5.8.1.

This OPTIONAL extension, when used, MUST be used at Service level only and only in the field defined in clause 5.5.9 (Service information extension). It is used to provide additional information on a service. This SHALL be a sequence of one or more tuples, each tuple giving:

1. (a)

   an URI identifying the additional information, e.g.:

   • an URI indicating some nationally defined specific qualification for a supervised/accredited Trust Service Token provisioning service, e.g.

     • a specific security/quality granularity level with regard to national supervision/accreditation scheme for CSPs not issuing QCs (e.g. RGS */**/*** in FR, specific ‘supervision’ status set by national legislation for specific CSPs issuing QCs in DE), see Note(4) of ‘Service current status’ — clause 5.5.4;

     • or a specific legal status for a supervised/accredited Trust Service Token provisioning (e.g. nationally defined ‘qualified TST’ as in DE or HU);

     • or meaning of a specific Policy identifier present in a X.509v3 certificate provided in ‘Sdi’ field.

   • or a registered URI as specified in ‘Service type identifier’, clause 5.5.1, in order to further specify the participation of the ‘Sti’ identified service as being a component service of a certification service provider issuing QC (e.g., OCSP-QC, CRL-QC, and RootCA-QC);

2. (b)

   an optional string containing the serviceInformation value, meaning as specified in the scheme (e.g. *, ** or ***);

3. (c)

   any optional additional information provided in a scheme-specific format.

F1Dereferencing the URI SHOULD lead to human readable information (as a minimum in EN and potentially in one or more national languages) which is deemed appropriate and sufficient for a relying party to understand the extension, and in particular explaining the meaning of the given URIs, specifying the possible values for serviceInformation and the meaning for each value.