Knowledge Base

In this article:

• EU Regulation 2025/2527 for Qualified Website Authentication Certificates (QWACs)
• What This Means for You
• 1. QWACs for Non-Browser Use
• 2. QWACs for Browser Use
• DigiCert's Current Roadmap
   

EU Regulation 2025/2527 for Qualified Website Authentication Certificates (QWACs)

The European Commission has adopted Commission Implementing Regulation (EU) 2025/2527, the implementing act under Article 45(2) of the amended eIDAS Regulation. It sets the reference standards for Qualified Website Authentication Certificates (QWACs). Combined with eIDAS 2.0 (Regulation (EU) 2024/1183), it obligates browsers to recognize QWACs issued by Qualified Trust Service Providers (QTSPs), including issuers that are not members of the traditional WebPKI browser root store programs.

The regulation cites ETSI EN 319 411-2 v2.6.1, ETSI TS 119 411-5 v2.1.1, and ETSI TS 119 495. DigiCert contributed to the development of all three standards via ETSI.

Separately, QWACs, including the PSD2 variants used in Open Banking, are affected by two changes happening in the WebPKI ecosystem:

• Google Chrome is deprecating the Client Authentication extended key usage (EKU) on March 15, 2027. DigiCert will stop including the Client Authentication EKU in browser-trusted TLS certificates on March 1, 2027. See Removing the Client Authentication EKU from Public TLS Certificates.
• The CA/Browser Forum is reducing the validity period and reuse periods for certain types of validated information, including domain control and subject identity validation. See Shortened TLS/SSL Certificate Validity: Frequently Asked Questions.

These changes are especially disruptive for PSD2 QWACs (as defined in ETSI TS 119 495), which typically require the Client Authentication EKU but typically do not require public browser trust.

As a result, the regulation splits QWACs into two categories: non-browser use and browser use.

What This Means for You

Action needed: You use PSD2 / Client Authentication QWACs today
Your certificates rely on the Client Authentication EKU, which DigiCert will remove from browser-trusted certificates on March 1, 2027. Plan to move to the new non-browser QNCP-w-gen option (see below) ahead of that date.

No action is needed right now: You use standard browser-trusted QWACs (QEVCP-w or QNCP-w) and don't rely on Client Authentication
Your certificates continue to work as is. You'll receive a separate notice ahead of the September 2027 root hierarchy transition.

Not yet available: You're evaluating the 2QWAC solution
Browsers are required to provide a user interface to display QWAC identity starting in 2027.  The 2QWAC was created to accommodate QTSPs who are not part of the webPKI root programs. A 2QWAC non-TLS identity certificate is used in conjunction with a normal webPKI TLS certificate.  As DigiCert’s webPKI QWACs will already provide browser UI, DigiCert will evaluate 2QWAC based on browser support and user demand. Treat this solution as something to watch rather than plan around today.

1. QWACs for Non-Browser Use

This covers machine-to-machine and API ecosystems, including PSD2 / Open Banking under ETSI TS 119 495.

Expected market behavior: there's little reason to hold non-browser certificates to the full CABF standard. QNCP-w-gen can draw on existing Qualified vetting regimes, such as those used for e-Seals, and simpler certificate profiles. Most non-browser use cases, PSD2 in particular, are expected to gravitate to QNCP-w-gen, which supports the Client Authentication EKU and longer validity periods that browser-aligned profiles can't offer as CABF-driven lifetime reductions take hold.

To deliver this, DigiCert is developing a private, non-browser certificate option for QWACs and PSD2 QWACs built on the eIDAS/ETSI QNCP-w-gen profile. This new option will appear only on the EU Trusted List (EUTL) and will not be included in browser trust stores.

The associated root and ICA hierarchy for this new certificate option is currently in audit. It will be made available to customers ahead of the Client Authentication EKU deprecation on March 1, 2027.
 

2. QWACs for Browser Use

There are two recognized paths to a browser-trusted QWAC: Direct issuance and 2QWACS.

• Direct issuance
  • QEVCP-w (EV) certificates issued from WebPKI-trusted hierarchies already work natively in browsers today.
  • DigiCert can issue these now. These browser-trusted certificates will no longer include the Client Authentication EKU starting March 1, 2027.
• 2QWAC (still evaluating)

  Important: Currently, browsers do not support the 2QWAC solution. The exact details required to bind the identity and domain certificates together are untested at this time.  As a WebPKI-capable issuer, DigiCert is not specifically required to issue 2QWACs, but DigiCert is watching the developments closely.

  • Defined in ETSI TS 119 411-5, this is a new construct pairing two certificates. A non-browser QNCP-w-gen certificate carrying a poison EKU (deliberately not valid for TLS server authentication) is used to sign a binding header served by the website, alongside a standard DV/OV/EV TLS certificate that terminates the actual TLS session. 
  • Qualified identity assurance is delivered without altering the browser's TLS trust decision.

If you use PSD2 QWACs today, note that 2QWAC addresses a different use case: your non-browser needs are served directly by QNCP-w-gen, not by 2QWAC.

In September 2027, browser-trusted QWACs will transition to a new root hierarchy to align with upcoming browser root program changes. DigiCert will update this article and notify customers with more detail on the transition to the new root hierarchy.

DigiCert's Current Roadmap

• Today: DigiCert can issue browser-recognized QEVCP-w (EV) from its WebPKI-trusted hierarchies.
• Before March 2027: DigiCert will launch non-browser QNCP-w-gen issuance to support PSD2 and other non-browser / machine-to-machine demand.
• Under evaluation: If browser support and customer demand for 2-QWAC materialize, DigiCert may extend the QNCP-w-gen service to support 2-QWAC profiles.