eIDAS trust infrastructure
EU trusted list and the LOTL
An EU trusted list is a signed, machine readable list that a member state publishes of the trust service providers it has qualified under eIDAS. The LOTL (List of Trusted Lists) is the European Commission's list pointing at all of them, and it is the root you start from when you want to know whether a certificate is qualified.
Also called: trusted list, TL, LOTL, List of Trusted Lists, EU trust list
At a glance
- LOTL
- The Commission's List of Trusted Lists, the root of the chain
- National lists
- One per member state, signed, naming qualified providers
- Format
- ETSI TS 119 612
- Answers
- Whether a certificate was qualified, for what service and when
- Not the same as
- The EUDI Lists of Trusted Entities (ETSI TS 119 602)
How the chain of lists works
You start at a single URL, the LOTL, published and signed by the Commission. It points at each member state's own trusted list, and each of those is signed too. A national list names the trust service providers that country supervises and, for each one, the services it has qualified: qualified certificates, qualified timestamps, qualified seals, with the certificates that identify them.
So "is this certificate qualified" is not a property you can read off the certificate. It is a question about whether that certificate appears on a national list, under a service type that was qualified, at the time the thing you are checking was signed. That last part is where implementations quietly go wrong: the lists carry service history, and a provider qualified today may not have been when the signature was made two years ago.
Two different kinds of list and the confusion between them
The eIDAS trusted lists above are the established infrastructure, defined in ETSI TS 119 612. They answer questions about signatures, seals and timestamps.
The EU Digital Identity Wallet ecosystem brought a second, separate family of registries, the Lists of Trusted Entities, defined in ETSI TS 119 602. Those answer a different question: which entities the wallet ecosystem trusts and in which role: as providers of person identification data, as attestation providers or as access certificate providers.
They look alike, they are both commonly called "the trusted list" and a certificate can sit on one while being irrelevant to the other. When someone tells you a certificate is on the trusted list, it is worth asking which one they mean. We built separate checkers for each because the answer is not transferable.
Why you would ever touch this
If you validate eIDAS signatures, the lists tell you whether the signing certificate was qualified. A qualified signature also needs a qualified signature creation device (Article 3(12)), and only a qualified signature carries the legal weight people assume they are getting. A valid signature from a provider nobody ever qualified is just a valid signature.
The lists are also not static. They are versioned, they carry a next update date and providers are added, suspended and withdrawn. Fetching one once and caching it forever is a correctness bug rather than an optimisation.
Check one yourself
Reading about it only gets you so far. These are free validators in Tessio.Labs, no signup and nothing you paste is stored.
EU Trusted List Checker
Paste a certificate and see whether it is a qualified CA on an EU trusted list and which national list it came from. It reports current status, not qualification as at some past date.
eIDAS Signature Validator
Check a PAdES, CAdES or JAdES signature, its timestamp and its trusted list qualification.
Why it matters
Validity and qualification are two different claims, and conflating them is how compliance positions end up resting on nothing. A signature can verify perfectly and still not be qualified. If your obligation is about qualified signatures, you have to resolve the certificate against the lists at the right point in time and say so.
If you're buying a validation tool, ask whether it tells you qualified or only valid. Then ask whether it evaluates qualification at signing time or at today's date.
Frequently asked
Is the LOTL the same as the trusted list the EU wallet uses?
No. The LOTL is the eIDAS chain, about qualified trust services and signatures. The wallet ecosystem publishes its own Lists of Trusted Entities under a different standard, about who is trusted to issue credentials or to ask for them. Both get called "the trusted list" and they answer different questions.
Does being on a trusted list make a signature valid?
No, these are independent. Cryptographic validity says the bytes were signed by that key and have not changed. The trusted list says whether the issuer behind that key was a qualified provider. You need both answers, and a tool that gives you only one isn't telling you what you think it is.
How often do the lists change?
Regularly. Each list carries a next update date, and providers get added, suspended and withdrawn between them. Any implementation that caches a list indefinitely will eventually give a confidently wrong answer.
Primary sources
This is a plain language explanation, not legal advice. Specifications and dates in this area move, so check anything you are going to rely on against the primary sources.
Keep reading
Age verification API
Or skip the theory and build against it
Tessio stores no documents or dates of birth and proves someone is over 18 with the EU age verification app (the EU Digital Identity Wallet follows once our access certificate is issued). Signup is open and a test project works as soon as you create one. Tell us what you're building.