eIDAS trust infrastructure
EU trusted list and the LOTL
An EU trusted list is a signed, machine readable list that a member state publishes of the trust service providers it has qualified under eIDAS. The LOTL, or List of Trusted Lists, is the European Commission's list pointing at all of them, and it is the root you start from when you want to know whether a certificate is genuinely qualified.
Also called: trusted list, TL, LOTL, List of Trusted Lists, EU trust list
At a glance
- LOTL
- The Commission's List of Trusted Lists, the root of the chain
- National lists
- One per member state, signed, naming qualified providers
- Format
- ETSI TS 119 612
- Answers
- Whether a certificate was qualified, for what service, and when
- Not the same as
- The EUDI Lists of Trusted Entities (ETSI TS 119 602)
How the chain of lists works
You start at a single URL, the LOTL, published and signed by the Commission. It points at each member state's own trusted list, and each of those is signed too. A national list names the trust service providers that country supervises and, for each one, the services it has qualified: qualified certificates, qualified timestamps, qualified seals, with the certificates that identify them.
So "is this certificate qualified" is not a property you can read off the certificate. It is a question about whether that certificate appears on a national list, under a service type that was qualified, at the time the thing you are checking was signed. That last part is where implementations quietly go wrong: the lists carry service history, and a provider qualified today may not have been when the signature was made two years ago.
Two different kinds of list, and the confusion between them
The eIDAS trusted lists above are the established infrastructure, defined in ETSI TS 119 612, and they answer questions about signatures, seals and timestamps.
The EU Digital Identity Wallet ecosystem brought a second, separate family of registries, the Lists of Trusted Entities, defined in ETSI TS 119 602. Those answer a different question: which entities the wallet ecosystem trusts, and in which role, as providers of person identification data, as attestation providers, or as access certificate providers.
They look alike, they are both commonly called "the trusted list", and a certificate can sit on one while being irrelevant to the other. When someone tells you a certificate is on the trusted list, it is worth asking which one they mean. We built separate checkers for each precisely because the answer is not transferable.
Why you would ever touch this
If you validate eIDAS signatures, this is the whole difference between "the signature is cryptographically valid" and "the signature is qualified". Only the second carries the legal weight people assume they are getting. A perfectly valid signature from a provider nobody ever qualified is just a valid signature, and treating the two as the same thing is the most common mistake in this area.
The lists are also not static. They are versioned, they carry a next-update date, and providers are added, suspended and withdrawn. Fetching one once and caching it forever is a correctness bug rather than an optimisation.
Check one yourself
Reading about it only gets you so far. These are free validators in Tessio Labs, no signup, and nothing you paste is stored.
EU Trusted List Checker
Paste a certificate and see whether it is a qualified CA on an EU trusted list, and which national list it came from. It reports current status, not qualification as at some past date.
eIDAS Signature Validator
Check a PAdES, CAdES or JAdES signature, its timestamp, and its trusted-list qualification.
Why it matters
Validity and qualification are two different claims, and conflating them is how compliance positions end up resting on nothing. A signature can verify perfectly and still not be qualified. If your obligation is about qualified signatures, you have to resolve the certificate against the lists, at the right point in time, and say so.
If you're buying a validation tool, that's the question to ask it: does it tell you qualified, or only valid, and does it evaluate qualification at signing time or at today's date.
Frequently asked
Is the LOTL the same as the trusted list the EU wallet uses?
No. The LOTL is the eIDAS chain, about qualified trust services and signatures. The wallet ecosystem publishes its own Lists of Trusted Entities under a different standard, about who is trusted to issue credentials or to ask for them. Both get called "the trusted list" and they answer different questions.
Does being on a trusted list make a signature valid?
No, these are independent. Cryptographic validity says the bytes were signed by that key and have not changed. The trusted list says whether the issuer behind that key was a qualified provider. You need both answers, and a tool that gives you only one isn't telling you what you think it's.
How often do the lists change?
Regularly. Each list carries a next-update date, and providers get added, suspended and withdrawn between them. Any implementation that caches a list indefinitely will eventually give a confidently wrong answer.
Primary sources
This is a plain language explanation, not legal advice. Specifications and dates in this area move, so check anything you are going to rely on against the primary sources.
Keep reading
Age verification API
Or skip the theory and build against it
Tessio proves someone is over 18 from their EU Digital Identity Wallet and stores no personal data. Access is invite only while we onboard design partners. Tell us what you're building.