Single domain
QWAC
€250/year
QWAC · eIDAS · Article 45
The certificate that proves who is behind a website.
A QWAC (Qualified Website Authentication Certificate) is the qualified certificate for website authentication defined in the European eIDAS Regulation. It binds a domain to an entity whose identity has been verified by a qualified, supervised provider, and it is recognised in every Member State of the European Union.
- Issued by qualified providers
- Recognised across the EU
- Required under PSD2
Key figures
The essentials at a glance.
Art. 45of the eIDAS Regulation, as amended by Regulation (EU) 2024/1183
27Member States: a QWAC issued in one is recognised in all the others
6 Jan 2027date from which the reference standards of Implementing Regulation (EU) 2025/2527 apply
Firefox 153the first major desktop browser to verify and display QWACs, in July 2026
In 30 seconds
A website certificate with a qualified identity.
An ordinary SSL/TLS certificate proves you are connected to the right domain and encrypts the connection. A QWAC adds a legal identity verified to the EU’s most demanding standard: who the company is, where it is registered and its registration number, attested by a qualified trust service provider.
Verified identity. The provider confirms the organisation’s legal existence and the identity of its representative, under audited rules supervised by a national authority.
Legal status. It is a qualified trust service under eIDAS: it appears on the EU trusted lists and benefits from mutual recognition between Member States.
It encrypts too. In its most common form, the QWAC is the website’s TLS certificate itself: it protects the connection like any other and works in every browser.
- Domain
- company.pt, www.company.pt
- Organisation
- Example Company, S.A.
- Registration number
- NTRPT-500000000
- Locality and country
- Lisbon, PT
- Qualified indication
- QcCompliance · QcType: web
- Policy
- QEVCP-w (ETSI EN 319 411-2)
- Issued by
- European qualified provider
- Validity
- up to 200 days (browser rules in 2026)
Who needs one
When an ordinary certificate is not enough.
A QWAC is not for every website. It is for organisations that must prove to customers, partners or regulators that an online service really is theirs.
Banks and payments
PSD2 requires payment service providers to identify themselves to each other with QWACs or qualified electronic seal certificates. PSD2 QWAC
Public bodies
Public services that want to prove the identity of their portals with a certificate whose legal status is recognised across the Union.
Regulated sectors
Insurance, health, energy, telecoms: organisations subject to NIS 2 or sector supervision that want their identity confirmed at qualified level.
Business-to-business APIs
Machine-to-machine connections where each party must know, with legal certainty, who is on the other side.
Brands targeted by phishing
Online shops and heavily imitated brands that want to give customers a verifiable way to recognise the genuine site.
Trust services
Signature, registered email or digital identity providers, for whom consistency with eIDAS is part of the offer.
Timeline
From the 2014 eIDAS to eIDAS 2.
QWACs have existed since 2016, but it was the 2024 revision that gave them weight: browsers now have to recognise them, and in 2025 the Commission set the technical standards that providers must follow from January 2027.
- Regulation (EU) No 910/2014 (eIDAS)
Creates qualified certificates for website authentication (Article 45 and Annex IV).
- Trust service rules apply
The first QWACs are issued by qualified providers.
- PSD2 applies to banking APIs
Delegated Regulation (EU) 2018/389 requires QWACs or QSealCs from payment service providers.
- eIDAS 2 enters into force
Regulation (EU) 2024/1183 obliges browsers to recognise QWACs (Articles 45 and 45a).
- Implementing Regulation (EU) 2025/2527
Sets the reference standards: ETSI EN 319 411-2, TS 119 495 and TS 119 411-5.
- Firefox 153
The first major desktop browser to verify and display QWACs by default.
- Reference standards apply
QWACs must follow the standards of the implementing regulation.
Explore
Everything there is to know.
What is a QWACDefinition, mandatory content, who issues them and how to check
Legislation and standardseIDAS, eIDAS 2, Articles 45 and 45a, Regulation 2025/2527, ETSI
1-QWAC and 2-QWACThe two technical models and what changes for the website
Browser supportFirefox, Opera, Chrome, Safari and Edge, and the controversy
PSD2 QWACOpen banking, PSD2 roles and client authentication
QWAC, DV, OV and EVWhat sets each certificate level apart
Get a QWACDocuments, timelines, prices and ordering
FAQStraight answers to the most common questions
GlossaryQTSP, QcStatement, JAdES, trusted list and other terms
Prices
QWAC and PSD2 QWAC, ordered online.
Per year, excluding VAT. Issued by European qualified providers. Up to 25% off 2- to 5-year subscriptions, with reissues included.
Up to 5 domains
Multi-domain QWAC
€425/year
Single domain
PSD2 QWAC
€350/year
Up to 10 domains
Multi-domain PSD2 QWAC
€500/year
Orders are placed on DigitalTrust, Sooma’s certificate service. How the process works.
Request a quote
Need a QWAC?
Tell us what you need the QWAC for and which domains it should cover. We confirm whether you need a standard or a PSD2 QWAC, which documents are required, and reply on the same business day.
Prefer to talk? +351 210 205 164
business days, 9:00 to 18:00 Lisbon time
By email: support@sooma.com