# What Is QWAC? Definition and Examples

> QWAC is a certificate issued by an EU qualified trust service provider under eIDAS that links a website to the verified legal or natural person running it.

Source: https://ssl.sh/glossary/qwac/
Last updated: 2026-11-10

A Qualified Website Authentication Certificate (QWAC) is a certificate defined by the EU [eIDAS](https://ssl.sh/glossary/eidas/) regulation that authenticates a website and identifies the legal or natural person behind it. Only a Qualified Trust Service Provider (QTSP), supervised by a national body and listed on an EU Trusted List, can issue one, and it must meet the eIDAS requirements for qualified certificates, which include identity verification comparable to [EV](https://ssl.sh/glossary/ev-certificate/). QWACs carry qcStatements that mark them as qualified.

## Why it matters
QWACs give website identity legal standing across the EU. Under the PSD2 open banking framework, payment service providers use eIDAS certificates, including QWACs, to identify themselves to banks' APIs, typically as the client certificate in [mutual TLS](https://ssl.sh/glossary/mtls/). The revision of eIDAS by Regulation (EU) 2024/1183 added Article 45 obligations for web browsers to recognise QWACs. The provision was heavily debated because of its potential effect on browsers' independent [root programs](https://ssl.sh/glossary/root-program/), and how it is applied in practice depends on implementing acts and technical standards.

## Example
```text
Bank API (PSD2)  <--- mTLS --->  Third-party provider
  the bank verifies the client QWAC:
  - issued by a QTSP on an EU Trusted List
  - qcStatements mark it as a qualified website certificate
  - the organization identifier matches the provider's licence
```

## Common misconceptions
- **A QWAC is just an EV certificate.** The vetting is similar, but a QWAC's status comes from EU law and the QTSP's supervision, not from CA/Browser Forum guidelines.
- **QWACs encrypt more strongly.** The cryptography is the same as for any other TLS certificate.
- **Every certificate from a European CA is a QWAC.** Only certificates issued as qualified by a QTSP are.

## Related terms

- [eIDAS](https://ssl.sh/zh/glossary/eidas/): eIDAS 是欧盟关于电子身份识别和信任服务的条例，为电子签名、电子印章、时间戳和网站认证等提供统一的法律规则。
- [EV 证书](https://ssl.sh/zh/glossary/ev-certificate/): EV 证书是按照 CA/浏览器论坛《EV 指南》完成最严格身份审核后签发的 TLS 证书。
- [mTLS](https://ssl.sh/zh/glossary/mtls/): mTLS 是服务器和客户端在握手中都用 X.509 证书向对方证明身份的 TLS，也叫双向 TLS 认证。
- [客户端证书](https://ssl.sh/zh/glossary/client-certificate/): 客户端证书是 TLS 客户端在握手时出示、用来向服务器证明自身身份的 X.509 证书。
- [根证书计划](https://ssl.sh/zh/glossary/root-program/): 根证书计划是浏览器或操作系统厂商用来决定其信任库收录、限制或移除哪些根 CA 的政策与流程。
- [信任库](https://ssl.sh/zh/glossary/trust-store/): 信任库是操作系统、浏览器或编程语言运行时内置的一组根 CA 证书，验证证书链时以它们作为信任锚。
- [证书颁发机构](https://ssl.sh/zh/glossary/certificate-authority/): 证书颁发机构（CA）是负责审核申请者、签发数字证书，并把公钥与域名或身份绑定在一起的机构。