Qualified website authentication certificate (QWAC)
A QWAC is an EU eIDAS qualified certificate that proves the verified identity behind a website, used widely in PSD2 open banking APIs.
A QWAC is an EU eIDAS qualified certificate that authenticates a website: it proves, with QTSP-verified evidence, which natural or legal person operates the site - on top of the TLS encryption itself. It is defined under eIDAS Article 45 and Annex IV. Issuing QWACs is one of the qualified trust services a QTSP may offer, listed on the EU Trusted List, which relying parties can check to confirm a QWAC's qualified status.
A QWAC serves a similar purpose to the Extended Validation (EV) and Organisation Validation (OV) certificates in the wider web-PKI ecosystem, which also verify organisational identity beyond domain control; OV certificates remain in routine use today, though browsers stopped displaying the distinct EV identity indicator around 2018-2019. Unlike EV/OV certificates, a QWAC's qualified status rests on eIDAS supervision and appears on the EU Trusted List, rather than on each browser's own, self-defined validation criteria.
A QWAC is only trusted by a browser if the issuing QTSP's certificate authority is included in that browser's root store; qualified status under eIDAS does not by itself guarantee browser trust. ETSI TS 119 411-5 distinguishes two binding methods: a 1-QWAC is a single, standalone certificate carrying the qualified attestation, while a 2-QWAC binds the qualified attestation to a separate, browser-trusted TLS certificate - letting the site keep ordinary browser trust while still carrying verifiable qualified identity data alongside it. The 2-QWAC construction is how the root-store conflict is resolved in practice. eIDAS 2 addresses this further: Article 45(1a) obliges browser providers offering services in the EU to recognise and support QWACs issued by EU-supervised QTSPs, and to display the verified identity behind them to users; Article 45(2) mandates the technical reference standards for how this recognition works, set out in Implementing Regulation (EU) 2025/2527.
QWACs are commonly used in open banking: under PSD2, banks and payment providers identify each other's APIs with QWACs (and seal traffic with QSealCs, per ETSI TS 119 495).