eIDAS 2.0 and digital certificates are related but serve different purposes. Digital certificates are cryptographic credentials used to verify identity or secure communications, while eIDAS 2.0, which amends Regulation (EU) 910/2014 through Regulation (EU) 2024/1183, is a regulatory framework that defines how digital identity, trust services, and credentials are issued, recognised, and used across the EU. Digital certificates are one component within the broader eIDAS ecosystem.
The distinction matters because eIDAS 2.0 introduces new concepts, such as electronic attestations of attributes and the European Digital Identity Wallet, that go well beyond what traditional certificates can do. The sections below walk through the key differences, how the two relate, and what this means for organisations that rely on certificates today.
How does eIDAS 2.0 go beyond traditional digital certificates?
eIDAS 2.0 creates a complete framework for digital identity that covers authentication and signing, and also the portable, user-controlled sharing of verified personal and organisational data. Where traditional certificates focus on proving a key belongs to an entity, eIDAS 2.0 enables people and businesses to share specific attributes, such as qualifications or age, without exposing unnecessary personal information.
The original eIDAS regulation, in force since 2014, established mutual recognition of electronic ID systems across EU Member States and introduced qualified trust services including electronic signatures and certificates. However, it left significant gaps: participation was optional for Member States, coverage of the private sector was limited, and there was no standardised way for citizens to carry their identity credentials across borders in a single, secure application.
eIDAS 2.0 addresses these gaps by making the European Digital Identity Wallet mandatory for all Member States. Every EU citizen, resident, and business will be able to use a wallet to store verified identity data, documents such as diplomas or driving licences, and to authenticate or sign digitally across both public and private sector services. Governance of the EUDI Wallet is a shared responsibility: the European Commission manages the legal framework and adopts implementing acts; Member States provide or mandate wallet solutions, certify and notify them, and supervise actors within their jurisdiction; the European Digital Identity Cooperation Group supports cooperation and cross-border alignment; and wallet providers, issuers, qualified trust service providers, and relying parties each carry distinct roles within the ecosystem. This distributed model shifts the overall approach from a collection of technical standards for certificates towards a full identity ecosystem built on interoperability, user control, and regulatory certainty.
What are qualified digital certificates under eIDAS?
Qualified digital certificates under eIDAS are cryptographic certificates issued by a Qualified Trust Service Provider (QTSP) that meet the highest security and legal standards defined in the regulation. They are used primarily for qualified electronic signatures (QES) and qualified electronic seals, and they carry significant legal standing across all EU Member States. A QES has the same legal effect as a handwritten signature. A qualified electronic seal has a different legal effect and confirms the origin and integrity of data issued by a legal entity; it is not equivalent to a signature.
There are two main types relevant to most organisations:
- Qualified certificates for electronic signatures: Issued to natural persons, these bind a public key to a verified individual identity and are used to sign documents with full legal standing under EU law.
- Qualified certificates for electronic seals: Issued to legal entities such as companies or public bodies, these confirm that a document or data originates from a specific organisation and has not been altered.
QTSPs that issue these certificates are listed on national trusted lists, published by each EU Member State and compiled into the EU List of Trusted Lists (LOTL). This public infrastructure is what gives qualified certificates their cross-border legal recognition. A certificate issued by a QTSP in the Netherlands, for example, is recognised in Germany, France, or any other Member State without additional verification steps.
Under eIDAS 2.0, the scope of qualified trust services expands further to include new categories such as qualified electronic attestations of attributes (QEAAs), which are a form of electronic attestation of attributes discussed in the next section.
How do electronic attestations of attributes differ from digital certificates?
Electronic attestations of attributes differ from digital certificates in what they represent and how they are used. A digital certificate proves that a cryptographic key belongs to a specific entity. An electronic attestation of attributes proves that a specific claim about a person or organisation is true, for example that someone holds a valid driving licence, has completed a degree, or is authorised to act on behalf of a company.
This distinction has practical consequences. With a traditional certificate, the relying party receives proof of identity at the cryptographic level. With an electronic attestation of attributes, the holder can selectively share only the attributes that are relevant to a given interaction. Someone proving they are over 18 does not need to share their full date of birth. Someone proving professional qualifications does not need to share their home address. This selective disclosure is a core privacy feature of the attestation model.
Under eIDAS 2.0, three categories of electronic attestations of attributes exist within the regulated trust framework:
- Qualified electronic attestations of attributes (QEAAs) are issued by QTSPs and carry the highest legal standing, comparable to qualified certificates, but they are designed to describe attributes rather than bind keys.
- Public-body electronic attestations of attributes (PuB-EAAs) are issued by or on behalf of public bodies and carry their own distinct legal standing under the regulation.
- Non-qualified electronic attestations of attributes (EAAs) are issued by other providers and carry a lower level of assurance.
QEAAs and PuB-EAAs are the primary building blocks for what users will store and share through the EUDI Wallet.
In technical terms, the EUDI Wallet architecture, as set out in the Architecture and Reference Framework (ARF), prescribes the credential formats mdoc and SD-JWT VC, with protocols including OID4VCI for issuance and OID4VP for presentation. ISO/IEC 18013-5 applies to proximity presentation and ISO/IEC TS 18013-7 to online presentation. Traditional digital certificates follow X.509 standards. Both rely on cryptographic signatures for tamper-evidence, but they serve different purposes within the digital identity landscape.
Can digital certificates and eIDAS 2.0 work together?
Yes, digital certificates and eIDAS 2.0 work together and will continue to do so. Qualified certificates remain a central part of the eIDAS 2.0 trust framework, particularly for electronic signatures, electronic seals, and website authentication. eIDAS 2.0 does not replace certificates; it expands the ecosystem around them.
The practical relationship looks like this:
- Certificates underpin trust services: QTSPs still issue qualified certificates for signatures and seals. These remain legally required for many regulated processes, such as signing contracts, authenticating official documents, or sealing data exchanged between organisations.
- Wallets can carry certificate-based credentials: The EUDI Wallet is designed to store and present both traditional identity documents and electronic attestations of attributes. In some flows, a qualified certificate may be used to sign an attestation that is then presented from the wallet.
- Attribute attestations complement certificates: Where a certificate proves who you are, a QEAA or PuB-EAA proves something about you. Together, they cover a wider range of identity and compliance use cases.
For organisations operating in regulated sectors such as financial services or government, this means existing certificate-based infrastructure does not become obsolete. It becomes one layer within a richer identity architecture that also supports wallet-based interactions and attribute sharing.
What does this mean for organisations using certificates today?
For organisations that rely on digital certificates today, eIDAS 2.0 signals a period of expansion. Qualified certificates for signatures and seals remain valid and legally recognised. However, organisations will increasingly need to support new interaction patterns that go beyond what certificates alone can deliver, particularly as the EUDI Wallet becomes more widely adopted.
The most immediate considerations are:
- Compliance readiness: eIDAS 2.0 introduces new obligations for specific regulated sectors and service providers. 24 December 2026 is the legal deadline by which each EU Member State must have at least one certified EUDI Wallet available for citizens, residents, and businesses, and public bodies must accept notified wallets as a means of identification for online services requiring electronic identification from that date. It is important to note that practical interoperability and national rollout may develop in phases: the legal deadline does not guarantee that every national wallet will have reached the same level of maturity, or that every cross-border use case will be fully operational throughout Europe on that date. Regulated private sector organisations, including those in banking and financial services, healthcare, telecoms, energy, transport, education, social security, drinking water, postal services, digital infrastructure, and digital services, are required under Article 5f to accept the EUDI Wallet where strong user authentication is legally or contractually required, with that obligation taking effect on 24 December 2027. Very large online platforms (VLOPs) with more than 45 million users in the EU are subject to a separate provision under Article 5f: the obligation applies where the platform requires user authentication, on the voluntary request of the user, and for the minimum necessary data. Micro and small enterprises, defined as organisations with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros, are exempt from the private sector acceptance obligation. Organisations in scope need to assess whether their current identity infrastructure can accommodate wallet-based flows alongside certificate-based ones, and should begin that assessment now rather than waiting for a single European go-live moment.
- Relying party registration: Under CIR (EU) 2025/848 of 6 May 2025, a relying party must register with the national authority of its Member State of establishment before it can request wallet data. Registration is per intended use, specifying which attributes and attestations will be requested. The wallet checks requests against this registered scope. A relying party must be able to accept every relevant notified wallet, regardless of provider. A vendor that processes wallet data on behalf of a client does not thereby become the relying party: the registration obligation rests with the organisation delivering the service to the end user.
- Interoperability: The EUDI Wallet framework is designed so that a certified wallet from one Member State can be used with an appropriate relying party in another Member State. However, this does not mean that every use case will immediately be available in every Member State, that national registration requirements disappear, or that sector-specific legislation ceases to apply. Systems that today rely solely on X.509 certificates for identity verification may need to be updated to handle electronic attestations of attributes and EUDI Wallet presentations, which use different technical standards including mdoc and SD-JWT VC.
- Verification: Verifying an attestation presented from a wallet involves three distinct checks: verification of the issuer’s signature against the relevant national trusted lists (compiled in the EU List of Trusted Lists); checking the revocation status via the issuer’s status information; and validation of the wallet unit attestation to confirm that the presenting wallet runs on a certified wallet solution. Only the first of these checks can be performed fully offline.
- User experience: Certificates are largely invisible to end users, managed by software or hardware tokens. The EUDI Wallet puts identity management directly in the hands of users, which changes how onboarding, authentication, and consent flows are designed. Wallet use is voluntary, and users approve each individual presentation request.
- Sector-specific requirements: In healthcare and pharmaceuticals, for example, electronic attestations of attributes could replace paper-based processes for prescriptions or professional qualifications, while qualified certificates continue to underpin document signing and audit trails. Recognition of professional qualifications remains governed by Directive 2005/36/EC; eIDAS 2.0 does not alter those rules.
Organisations that act early will be better positioned to handle the transition without disruption. This means auditing current certificate use cases, identifying where electronic attestations of attributes or wallet-based flows could add value, and building towards an architecture that supports both in parallel. Reviewing your implementation approach now, rather than waiting for regulatory deadlines, reduces risk and creates a more scalable foundation for digital identity.
How TrustTech supports eIDAS 2.0 and digital certificate use cases
As organisations move from certificate-only infrastructure towards a broader identity architecture that includes wallet-based flows and electronic attestations of attributes, the practical challenge is connecting these layers without rebuilding from scratch.
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
In the context of certificates and eIDAS 2.0, the ID Connector handles:
- Wallet acceptance across certified wallet solutions, regardless of the issuing Member State
- Verification of issuer signatures against national trusted lists compiled in the EU List of Trusted Lists
- Revocation status checks via issuer-provided status information
- Validation of wallet unit attestations to confirm the presenting wallet runs on a certified wallet solution
- Enforcement of the registered attribute scope per intended use, as required under CIR (EU) 2025/848
- Qualified signing via a connected QTSP, for use cases that continue to require a QES
This is relevant across financial services, healthcare, pharma, and government, where certificate-based processes and wallet-based interactions will run in parallel for the foreseeable future.
To discuss how the ID Connector fits your current certificate infrastructure and your path to EUDI Wallet acceptance, get in touch.