.NET eIDAS Certificate Validator: Is a Certificate Qualified?

The library is written for eIDAS. It uses the official list of lists (LOTL) and the national Trusted Lists published by the EU member states, and it answers the question that comes before any signature check: can I trust this certificate as a qualified one?

What it tells you about a certificate

• Is it qualified? The result is a qualified certificate, the certificate of a qualified trust service (a CA or a time-stamping unit), a listed but not qualified certificate, or a certificate that is not in any Trusted List.
• Which branch does the issuer belong to? Qualified certificate for electronic signature, for electronic seal or for website authentication (QWAC); qualified validation and preservation services for qualified signatures and seals; qualified time stamp; qualified remote management of signature and seal creation devices (plus qualified electronic delivery, archiving and attestation of attributes).
• Type and device: electronic signature (natural person), electronic seal (legal person) or website authentication, and whether the private key is in a QSCD, including a QSCD managed on behalf of the signatory.
• Where it comes from: the country, the trust service provider, the service, its status when the certificate was issued and its current status, and the URL of the national Trusted List (XML) where the service appears.
• What the certificate declares: its qualified certificate statements (QcCompliance, QcSSCD, QcType) and its ETSI certificate policies (QCP-n, QCP-l, QCP-n-qscd, QCP-l-qscd, QCP-w), cross-checked with the list. Inconsistencies are reported as warnings.
• Revocation (optional): OCSP first, then CRL. The revocation status is informative: a revoked or expired certificate keeps its qualified status.

Built for eIDAS

How to check a certificate in C#

Create one EuTrustedListService and use it for every check: it keeps the Trusted Lists in memory. The lists are downloaded the first time.

using System;
using EUTLValidator;

// Create one service and use it for every check. The Trusted Lists are downloaded the first time
// and kept in a cache folder (%LOCALAPPDATA%\EUTLValidator\cache), where they are refreshed when needed.
EuTrustedListService service = new EuTrustedListService();

// A .cer file: DER, PEM or Base64. There are also Check(X509Certificate2) and Check(byte[]).
CertificateQualificationResult r = service.CheckFile(@"certificate.cer");

Console.WriteLine("Status: " + r.Status);   // QualifiedCertificate, QualifiedTrustService, NotQualified, NotListed
Console.WriteLine("Is qualified: " + r.IsQualified);
Console.WriteLine("Branches of the issuing service: " + r.Branches);
Console.WriteLine("Certificate type: " + r.CertificateType + ", private key in a QSCD: " + r.Qscd);

if (r.Service != null)
{
    Console.WriteLine("Country: " + r.Service.Country);
    Console.WriteLine("Trust service provider: " + r.Service.TspName);
    Console.WriteLine("Service status when the certificate was issued: " + r.Service.StatusAtIssuance);
    Console.WriteLine("Trusted List: " + r.Service.TrustedList.Url);
}

The service can be configured: the cache folder, the refresh interval, the revocation check, the proxy of the network, a custom HttpMessageHandler. The same service can also answer for another moment in time, or use the intermediate certificates that you already have.

// Another cache folder and another refresh interval
var service = new EuTrustedListService(@"D:\EUTL cache", TimeSpan.FromDays(1));

// All the settings: the revocation status (OCSP, then CRL), the proxy of the network...
var options = new EuTrustedListOptions
{
    CheckRevocation = true,
    Proxy = new WebProxy("http://proxy.company.com:8080")
};
var service = new EuTrustedListService(options);

// Was the certificate qualified at another moment (a signature time, a time-stamp time)?
CertificateQualificationResult past = service.CheckAt(certificate, new DateTime(2024, 5, 1));

// The issuer is looked for first among the certificates you give.
CertificateQualificationResult r = service.Check(certificate, new[] { intermediateCertificate });

The complete C# sample, with the explanation of every step, is on the page Is a Certificate Qualified? Check It in C# with the EU Trusted Lists.

More features

• Reads .cer files in DER, PEM or Base64 format.
• Accepts the intermediate certificates of the chain, or downloads a missing issuer through the AIA extension.
• Proxy and custom HTTP handler support for corporate networks.
• The result can be exported as JSON with ToJson().
• For every answer, the reasons and the warnings explain how the decision was made.

Platforms and requirements

.NET 10, .NET 11 and .NET Framework, with the same API. No third-party libraries. Internet access is needed the first time, to download the Trusted Lists.

From checking a certificate to signing and validating documents

.NET eIDAS Certificate Validator is free and answers one question about one certificate. Most projects that need it also have to create and verify the signatures. That is what the .NET Digital Signature Library (SignLib) does: PAdES (PDF), CAdES (.p7m, .p7s), XAdES (XML) and ASiC-E signatures at the baseline levels B-B, B-T, B-LT and B-LTA, with certificates from the Windows store, a PFX file, a smart card, a USB token or an HSM.

Use them together

The signature library gives you the signing certificate of each signature, and .NET eIDAS Certificate Validator tells you whether that certificate was qualified when the document was signed.

// Signature Library: read the signatures of a signed PDF
PdfSignature verifier = new PdfSignature(LibrarySerialNumber);
verifier.LoadPdfDocument(signedPdf);

// .NET eIDAS Certificate Validator: is the certificate of each signer qualified, at the time of the signature?
EuTrustedListService service = new EuTrustedListService();

foreach (PdfSignatureInfo info in verifier.DocumentProperties.DigitalSignatures)
{
    CertificateQualificationResult q = service.CheckAt(info.SignatureCertificate, info.SignatureTime);

    Console.WriteLine(info.SignatureName + ": signature intact " + info.SignatureIsValid
        + ", certificate qualified " + q.IsQualified + " (" + q.Branches + ")");
}

Explore the .NET Digital Signature Library →

Frequently asked questions

The information on this page is simplified and is not legal advice. The Trusted Lists are published by the EU member states; the result depends on their content.