Trusted List (EU trust list)
Definition
Frequently asked questions
What is a trust list for?
It allows any person and any software to know whether a provider and the service it provides have qualified status. Article 22 of the eIDAS regulation requires each Member State to publish one. Registration has a constitutive effect: a service is qualified only if it appears there with this status.
Who maintains these lists?
Each Member State designates the body responsible for establishing, maintaining and publishing its national list; in France, this is ANSSI. The European Commission for its part publishes a list of lists, which records the locations of all national lists and the certificates used to verify their authenticity.
How does software use the trust list?
The lists are published in a machine-readable format and electronically signed. When validating a signature, the software downloads the list of lists, then the relevant national list, and verifies that the authority that issued the certificate appears there with a qualified status on the date of the signature. The result is displayed to the user.
What happens to a signature if the provider loses its status?
The withdrawal of the status only applies to the future. The trust list retains the history of statuses, with their dates: a signature created while the service was qualified remains a qualified signature. This is one of the reasons why the timestamp of the signature is important, since it makes it possible to establish the date on which it was created.
Related guides
Related terms
Ready to put these concepts into practice?
Certyneo allows you to create signature envelopes compliant with eIDAS in just a few clicks, without installation.