Skip to main content

Issue EU qualified website authentication certificates (QWACs) via CertCentral

Use DigiCert​​®​​ Trust Lifecycle Manager to issue and manage EU qualified website authentication certificates (QWACs) from CertCentral for deployment to servers, vaults, network appliances, and cloud services. DigiCert issues QWACs under the EU eIDAS regulation as a Qualified Trust Service Provider (QTSP). A QWAC works as a standard X.509 TLS server certificate that also carries qualified organizational identity, which supports use cases such as Open Banking and PSD2 deployments.

Before you begin

General prerequisites

For help verifying or enabling these prerequisites, contact your DigiCert account representative.

  • QWAC enrollments use the Admin web request method. The Automation feature must be enabled for your Trust Lifecycle Manager account.

  • You need an active CertCentral connector in Trust Lifecycle Manager. The connected CertCentral account must be in the EU region. QWACs are not available to accounts in other regions.

  • Trust Lifecycle Manager currently supports the following CertCentral products for QWACs:

    • EU Qualified Website Authentication Certificate

    • EU Qualified Website Authentication PSD2 Certificate

    Note

    For details about these certificate products, see EU (eIDAS) products.

Organization validation and verified contact

Before DigiCert can issue your QWAC certificate, we must complete organization validation using one of the following options:

  • Prevalidate your organization in CertCentral for faster issuance. See TLS certificate organization validation process.

  • Validate as part of the order: Add a new or expired organization and DigiCert will complete validation as part of the order process.

The organization must have at least one verified contact. When you create the QWAC certificate profile, you must select a verified contact for the organization. See Verified contacts.

Domain validation

Before DigiCert can issue your QWAC certificate, domain control must be demonstrated using one of the following options:

  • Prevalidate your domains in CertCentral for faster issuance. See Perform domain control validation (DCV).

  • Validate as part of the order: Add new or expired domains and complete validation manually as part of the CertCentral order.

Create QWAC certificate profiles

To create a profile for issuing QWAC certificates in Trust Lifecycle Manager:

  1. From the Trust Lifecycle Manager menu, go to Policies > Certificate profiles.

  2. Select the Create profile from template action at the top of the page.

  3. Select the base template CertCentral Public Server Certificate as the starting point for creating the new certificate profile.

    Work through the profile creation wizard, focusing on the QWAC-related options described in the following steps and making other selections for your business needs. After filling out each screen, select Next to move to the next screen.

  4. On the initial Primary options screen of the profile creation wizard, configure the:

    • Profile name: Give the profile a user-friendly name to help identify it.

    • Business unit: Assign the business unit for certificates issued from this profile.

    • Connector: Select the connector for the EU region CertCentral account to issue QWACs from.

    • CertCentral division: Select the division for the issued QWACs in the linked CertCentral account.

    • Certificate type: Select one of the supported QWAC products, either EU Qualified Website Authentication Certificate or EU Qualified Website Authentication PSD2 Certificate.

    • Enrollment method: Select Admin web request. This is the only enrollment method currently supported for QWACs.

  5. On the Certificate options screen:

    • Key type and sizes: Select one or more of the supported RSA key sizes (3072 and 4096). The profile can be used to issue certificates for any of the key sizes you select.

    • Auto-renew: Enable this option to automatically renew all QWACs issued from this profile. Keep the default setting to auto-renew certificates 30 days before expiration, or configure a custom schedule.

  6. On the Additional options screen:

    • Organization: Select the organization for the QWACs. Select Hide non-validated organizations to list only organizations that are validated in CertCentral.

    • Verified contact: Select a verified contact at the selected organization to use for QWACs issued from this profile.

    • Tags and Certificate owners: DigiCert recommends using these metadata fields to help identify, organize, and manage the QWACs in your Trust Lifecycle Manager inventory.

  7. Select Create to save the QWAC certificate profile.

Enroll and manage QWAC certificates

Use the Admin web request function to enroll new QWACs from the profile with automated delivery to servers, vaults, network appliances, or cloud services.

Once a QWAC is enrolled and delivered, use the managed automation functions in Trust Lifecycle Manager to manage the lifecycle of the deployed certificate on an ongoing basis.

What's next

: