A qualified website authentication certificate (QWAC) is a specific type of digital certificate issued by a qualified trust service provider (QTSP) under eIDAS 2.0 that cryptographically confirms the legal identity of the organisation behind a website. eIDAS 2.0, formally Regulation (EU) 2024/1183, amends Regulation (EU) 910/2014 and gives QWACs a legally recognised level of assurance across all EU Member States, providing website visitors with verified proof of who they are dealing with.
Under eIDAS 2.0, QWACs play a growing role in the broader digital identity landscape, particularly as organisations prepare for the European Digital Identity Wallet. The sections below answer the most common questions about how QWACs work, who needs them, and how to get one.
How does a QWAC differ from a standard SSL/TLS certificate?
A QWAC differs from a standard SSL/TLS certificate primarily in its legal status and the depth of identity verification behind it. While any SSL/TLS certificate encrypts the connection between a browser and a server, a QWAC also provides legally recognised proof of the organisation’s identity under EU law, issued by a QTSP that is listed on a national trusted list.
Standard SSL/TLS certificates come in several types. Domain Validation (DV) certificates only confirm that the applicant controls the domain. Extended Validation (EV) certificates go further with organisational checks, but they carry no legal standing under EU regulation. A QWAC, by contrast, meets strict requirements defined in eIDAS 2.0 and is backed by a qualified trust service provider accountable under European law.
In practical terms, this means a QWAC communicates something more meaningful to both users and relying parties: the connection is encrypted and the identity behind the website has been formally verified and is legally attributable.
What requirements must a QWAC meet under eIDAS 2.0?
Under eIDAS 2.0, a qualified website authentication certificate must be issued by a qualified trust service provider listed on an EU Member State’s trusted list, and it must contain a verified set of identity attributes about the organisation operating the website. The certificate must conform to the reference standards established by the European Commission’s implementing acts, which contain the legally binding requirements that QTSPs must follow.
Specifically, a QWAC issued under eIDAS 2.0 must include:
- The full legal name of the organisation
- The country of establishment
- The domain name(s) the certificate covers
- An indication that it is a qualified certificate for website authentication
- The identity of the issuing QTSP and a reference to its qualified status
The QTSP issuing the QWAC must verify the organisation’s identity before issuance, following defined procedures. This is a significant step beyond the automated domain checks used for standard certificates. The European Commission has published implementing acts covering reference standards for qualified certificates for website authentication, providing the technical baseline that QTSPs must follow. The Architecture and Reference Framework (ARF) elaborates on these requirements technically but is not itself legislation and is not legally binding.
Which organisations are required to use a QWAC?
Under eIDAS 2.0, certain categories of websites operated by public sector bodies and regulated service providers are required to support qualified website authentication certificates. The regulation specifically addresses websites that need to provide users with a high level of assurance about the organisation’s identity, particularly in contexts where trust is critical.
In practice, the organisations most directly affected include:
- Public sector bodies offering digital government services
- Financial institutions and banks operating online platforms
- Healthcare providers handling sensitive personal data
- Organisations acting as relying parties in the EUDI Wallet ecosystem
Beyond regulatory obligations, many private sector organisations in trust-sensitive industries are choosing to adopt QWACs voluntarily. If your organisation operates in financial services or government services, a QWAC signals to your users and counterparties that your identity has been formally verified under EU law. This is increasingly relevant as digital interactions replace in-person processes and users become more aware of identity fraud risks.
How does a QWAC interact with the EUDI Wallet?
A QWAC plays a direct role in the EUDI Wallet ecosystem by enabling wallet users to verify the identity of the website or service they are interacting with before sharing any personal data. When a user presents credentials from their European Digital Identity Wallet to a relying party, the wallet can check the QWAC of the receiving website to confirm its legal identity before releasing any information.
This is a critical trust mechanism. The EUDI Wallet is designed to give users control over their data, and that control depends on users being able to verify who is requesting their data. A QWAC provides that assurance on the relying party side of the interaction.
It is important to understand how governance of the EUDI Wallet ecosystem is structured. The European Commission manages the legal framework and adopts implementing acts. Individual EU Member States are responsible for providing or mandating wallet solutions, certifying and notifying them, and supervising actors within their jurisdiction. The European Digital Identity Cooperation Group supports cross-border alignment and cooperation between Member States. National competent authorities, wallet providers, issuers of Person Identification Data and attestations, qualified trust service providers, and relying parties each carry distinct responsibilities within this shared governance model. No single central European authority operationally manages all EUDI Wallets.
For organisations preparing to become relying parties in the EUDI Wallet ecosystem, having a valid QWAC is a foundational element of the trust infrastructure that makes wallet-based interactions possible. It is also worth noting that relying parties must register with the national authority of their Member State of establishment under CIR (EU) 2025/848 of 6 May 2025 before they can request wallet data. Organisations exploring their approach to digital identity readiness should factor QWAC adoption into their broader eIDAS 2.0 preparation.
What is the difference between a QWAC and a QSeal certificate?
A QWAC and a QSeal (qualified electronic seal certificate) serve different purposes within the eIDAS 2.0 trust framework. A QWAC authenticates a website and confirms the legal identity of the organisation operating it. A QSeal is used to protect the integrity and origin of data or documents issued by an organisation, functioning as a digital equivalent of a company stamp. A qualified electronic seal has a distinct legal effect and is not equivalent to an electronic signature.
The key distinction comes down to what is being authenticated and in which direction. A QWAC tells a user visiting a website: “This site is operated by this verified legal entity.” A QSeal tells a recipient of a document or data package: “This content was issued by this verified legal entity and has not been altered.”
In the EUDI Wallet context, both certificates often work together. A relying party website might use a QWAC to identify itself to a wallet user, while also using a QSeal to sign the attestations or data it issues back to users. Understanding both is important for organisations building digital identity solutions that need to cover authentication, data integrity, and regulatory compliance in one coherent architecture.
How can an organisation obtain a QWAC?
To obtain a qualified website authentication certificate, an organisation must apply to a qualified trust service provider that is authorised to issue QWACs and is listed on an EU Member State’s trusted list. The process involves identity verification of the legal entity, domain ownership validation, and review of the application against the requirements defined in eIDAS 2.0.
The steps typically follow this sequence:
- Identify a qualified trust service provider on the relevant national trusted list that offers QWAC issuance in your jurisdiction.
- Submit an application with documentation confirming your organisation’s legal identity, registration details, and the domain names to be covered.
- Complete the identity verification process as required by the QTSP, which may include document checks and verification against official registers.
- Receive and install the certificate on your web server, replacing or supplementing your existing SSL/TLS certificate.
- Maintain and renew the certificate in line with the validity period set by the issuing QTSP, typically one to two years.
Organisations in healthcare, pharmaceutical and life sciences, and other regulated sectors should also consider how QWAC issuance fits into their wider compliance programme, particularly where eIDAS 2.0 obligations overlap with sector-specific regulations. Organisations operating across borders should also account for jurisdiction-specific requirements when planning their QWAC and broader eIDAS 2.0 compliance strategy, as relying party registration under CIR (EU) 2025/848 is tied to the national framework of each Member State of establishment.
How TrustTech supports qualified website authentication
Preparing for eIDAS 2.0 involves aligning your identity infrastructure, trust services, and compliance processes with a rapidly evolving regulatory framework. The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organisations working through QWAC adoption and broader eIDAS 2.0 compliance, the ID Connector supports:
- Verification of QWAC and trust service status against national trusted lists
- Validation of wallet unit attestations to confirm that a presenting wallet runs on a certified wallet solution
- Management of the registered attribute scope per relying party use case under CIR (EU) 2025/848
- Integration of qualified signing via a connected QTSP
- Cross-border interoperability for organisations operating across EU Member States
The ID Connector is relevant across financial services, healthcare, pharma, and government, where QWAC adoption intersects with sector-specific regulatory requirements. Get in touch with TrustTech to discuss how the ID Connector fits into your eIDAS 2.0 compliance architecture.