Behind every reliable digital signature sits an electronic certificate: a file that verifiably binds an identity (a person, a company) to a public key. Issued by a trusted certificate authority (CA), this certificate lets anyone verify a signature's authenticity and detect the slightest change to the document. This guide explains what a digital signature certificate is, how the chain of trust works (PKI, certificate authority, root certificate), what sets an eIDAS qualified certificate apart from an ordinary one, and how a signature stays verifiable even after the certificate is revoked or expires.
A digital signature certificate (or electronic certificate) is a file issued by a certificate authority that binds a public key to its holder's identity. In practice, when a signer applies their signature, the document is sealed with their private key; anyone holding the matching certificate can then use the public key it contains to verify two things: that the signature really comes from the identified holder, and that the document hasn't been modified since signing.
A certificate follows the X.509 standard and contains the holder's identity, their public key, the identity of the issuing certificate authority, a validity period, and the CA's signature guaranteeing it all. Its reliability rests not on the certificate alone but on the chain of trust that goes back to a recognised root authority. That chain — the PKI (Public Key Infrastructure) — turns a mere file into enforceable proof of identity.
A certificate never works alone: it belongs to an infrastructure whose essential components are below.
X.509 is the standard format of an electronic certificate. It describes the file's structure: serial number, holder identity (subject), public key, issuer identity, validity dates, permitted uses, and the CA's signature. It is the universal format used for signing, encryption and website TLS certificates.
A certificate authority (CA) is a trusted body that issues certificates and vouches for their holders' identity after verification. Qualified CAs are supervised by national authorities (ANSSI in France) and listed on the EU Trusted List. A CA can be a root, an intermediate or an issuing authority.
The PKI (Public Key Infrastructure) is the set of hardware, software, procedures and authorities that manage the certificate lifecycle: issuance, renewal, revocation, publication. It organises the chain of trust, from the root authority down to the end user's certificate.
A qualified certificate is issued by a qualified trust service provider (QTSP) listed on an EU member state's trusted list. It offers the highest assurance level recognised in Europe and is the prerequisite for a qualified signature (QES), the only electronic signature automatically equivalent to a handwritten one.
A certificate can be revoked before it expires (compromised key, departing employee, issuance error). Two mechanisms check whether a certificate is still valid: the CRL (list of revoked certificates published by the CA) and the OCSP protocol (real-time query of a certificate's status).
A certificate is only worth the trust placed in the authority that issued it. Four pillars guarantee that trust in Europe.
Each certificate is signed by an issuing CA, itself certified by an intermediate CA, up to a root CA whose certificate is self-signed and recognised by operating systems and browsers. Verifying a signature means walking that chain up to a trusted root.
Each member state publishes a Trusted List of its qualified providers and the services they offer. The European Commission aggregates these lists. A certificate issued by a QTSP on this list is recognised automatically across the entire European Union.
In France, ANSSI supervises qualified providers and publishes the General Security Framework (RGS), which defines the requirements for certificates used in exchanges with the public administration. It grants qualifications attesting a CA's compliance with these frameworks.
The European ETSI EN 319 411 standards define the security policies and requirements a certificate authority must meet to issue recognised certificates, qualified or not. It is against these standards that an accredited body audits a QTSP before its listing on the Trusted List.
The certificate level determines the achievable signature level and its legal value. Here are the six dimensions that set them apart.
| Dimension | Simple certificate | Advanced certificate | Qualified certificate |
|---|---|---|---|
| Issuer | Any CA, with no particular supervision. | CA meeting enhanced security requirements (ETSI). | Qualified provider (QTSP) on the eIDAS Trusted List. |
| Identity verification | Weak — often just email validation. | Enhanced identity verification of the holder. | In-person or equivalent (certified video identification). |
| Signature level enabled | Simple signature (SES). | Advanced signature (AES). | Qualified signature (QES). |
| Legal value | Admissible, but burden of proof on the issuer. | Admissible in court, reliability to be demonstrated. | Automatic equivalence with a handwritten signature. |
| EU recognition | No harmonised recognition. | Recognised, under conditions. | Recognised automatically across the European Union. |
| Typical use | Internal validation, acknowledgements. | Commercial contracts, HR, quotes. | Notarial deeds, public procurement, lawyer's deeds. |
Certyneo relies on certificates issued by qualified trust service providers listed on the European Trusted List. SES and AES included, QES at €14.90/act.
We use cookies to improve your experience on our site. Cookies strictly necessary for the service to function are always active. Learn more about our cookie policy
The QSCD certificate is the cornerstone of qualified electronic signatures in Europe. Discover its definition, legal framework and concrete steps to obtain one in France.
ISO 27001, eIDAS, ETSI… certifications for electronic signature service providers have become an essential selection criterion. Discover how to compare them effectively.
PKI is the cryptographic foundation of any reliable electronic signature. Discover how it works, its components and its link with X.509 certificates and the eIDAS regulation.
What is an electronic certificate, what is it used for and what is its link to digital signature?
eIDAS 2 regulation imposes new requirements on trust service providers. Discover the complete certification pathway to remain compliant in 2026.
The qualified electronic certificate is the legal foundation for any digital signature with high probative value. Discover how to obtain it, deploy it and stay compliant in 2026.