Recital 65

(65) The issuance of certificates for website authentication is intended to provide users with assurance with a high level of confidence in the identity of the entity standing behind the website, irrespective of the platform used to display that identity. Those certificates should contribute to the building of trust in conducting business online, as users would have confidence in a website that has been authenticated. The use of such certificates by websites should be voluntary. In order for website authentication to become a means by which to increase trust, to provide a better experience for the user and to foster growth in the internal market, this Regulation lays down a trust framework including minimal security and liability obligations for the providers of qualified certificates for website authentication and requirements for the issuance of those certificates. National trusted lists should confirm the qualified status of website authentication services and of their trust service providers, including their full compliance with the requirements of this Regulation with regard to the issuance of qualified certificates for website authentication. The recognition of qualified certificates for website authentication means that the providers of web-browsers should not deny the authenticity of qualified certificates for website authentication for the sole purpose of attesting the link between the website domain name and the natural or legal person to whom the certificate is issued or confirming the identity of that person. Providers of web-browsers should display the certified identity data and the other attested attributes to the end-user in a user-friendly manner in the browser environment, by technical means of their choice. To that end, providers of web-browsers should ensure support and interoperability with qualified certificates for website authentication issued in full compliance with this Regulation. The obligation of recognition and interoperability of and support for qualified certificates for website authentication does not affect the freedom of providers of web-browsers to ensure web security, domain authentication and the encryption of web traffic in a manner and by means of technology that they consider to be the most appropriate. In order to contribute to the online security of end-users, providers of web-browsers should, in exceptional circumstances, be able to take precautionary measures that are both necessary and proportionate in reaction to substantiated concerns regarding security breaches or the loss of integrity of an identified certificate or set of certificates. Where they take such precautionary measures, providers of web-browsers should notify, without undue delay, the Commission, the national supervisory body, the entity to which the certificate was issued and the qualified trust service provider that issued that certificate or set of certificates, of any concern with regard to such a security breach or loss of integrity as well as the measures taken relating to the single certificate or set of certificates. Those measures should be without prejudice to the obligation of the providers of web-browsers to recognise qualified website authentication certificates in accordance with the national trusted lists. To further protect Union citizens and residents in the Union and promote the use of qualified certificates for website authentication, public authorities in Member States should consider incorporating qualified certificates for website authentication in their websites. The measures provided for by this Regulation that aim to bring increased coherence between Member States’ divergent approaches and practices relating to supervisory procedures are intended to contribute to improved trust and confidence in the security, quality and availability of qualified certificates for website authentication.

← Recital 64 · All articles · Recital 66 →

Source: EUR-Lex (Cellar) · retrieved 2026-11-10 · Text as adopted (Official Journal); later amendments are not incorporated in this text.