QWAC (Qualified Website Authentication Certificate)

A Qualified Website Authentication Certificate (QWAC) is a certificate defined by the EU eIDAS regulation that authenticates a website and identifies the legal or natural person behind it. Only a Qualified Trust Service Provider (QTSP), supervised by a national body and listed on an EU Trusted List, can issue one, and it must meet the eIDAS requirements for qualified certificates, which include identity verification comparable to EV. QWACs carry qcStatements that mark them as qualified.

Why it matters

QWACs give website identity legal standing across the EU. Under the PSD2 open banking framework, payment service providers use eIDAS certificates, including QWACs, to identify themselves to banks' APIs, typically as the client certificate in mutual TLS. The revision of eIDAS by Regulation (EU) 2024/1183 added Article 45 obligations for web browsers to recognise QWACs. The provision was heavily debated because of its potential effect on browsers' independent root programs, and how it is applied in practice depends on implementing acts and technical standards.

Example

Bank API (PSD2)  <--- mTLS --->  Third-party provider
  the bank verifies the client QWAC:
  - issued by a QTSP on an EU Trusted List
  - qcStatements mark it as a qualified website certificate
  - the organization identifier matches the provider's licence

Common misconceptions

• A QWAC is just an EV certificate. The vetting is similar, but a QWAC's status comes from EU law and the QTSP's supervision, not from CA/Browser Forum guidelines.
• QWACs encrypt more strongly. The cryptography is the same as for any other TLS certificate.
• Every certificate from a European CA is a QWAC. Only certificates issued as qualified by a QTSP are.