PSD2 Qualified Website Authentication Certificate

PSD2-compliant Qualified Website Authentication Certificates (QWAC) for Enterprises, Businesses, and Organizations

A PSD2 QWAC enables identification and authentication of regulated Payment Service Providers (PSPs) in PSD2/Open Banking environments. These certificates support secure communications between financial institutions and third-party providers in accordance with PSD2 and eIDAS requirements.

700K
businesses on the

Sectigo platform
100M
certificates issued worldwide
#1
market leader

in SSL certificates
65%
of Fortune 1000

companies use Sectigo

Item 1 of 4

Sectigo QWAC Legal For PSD2

Delivered digitally.

Sectigo QWAC Legal For PSD2 Multi-Domain License

Delivered digitally.

Trusted leader in SSL/TLS certificates

PSD2 Compliance with QWACs

Where is it used? Identifies end points, protects data during communication
What are the security features? Confidentiality, authentication, and integrity
Is data protected when passed through an intermediary? Protects in direct peer-to-peer communications
What else is needed for compliance? Qualified Certificate for Electronic Seals (QSealC) are another type of digital certificate needed for secure communications

PSD2 QWAC Certificates

The Payment Services Directive (PSD2) is a regulatory framework that supports secure payments across the European Union. PSD2-compliant QWACs are qualified certificates used for identification and authentication of regulated Payment Service Providers (PSPs) in PSD2/Open Banking communications. They support secure API communications and mutual TLS authentication between banks and third-party providers.

Sectigo is an accredited Qualified Trust Service Provider (QTSP) and issues eIDAS certificates, including QWACs. Once these types of certificates are ordered, Sectigo validates the identity that is named in the certificate through a series of checks that conform to the PSD2 Regulatory Technical Standards (RTS) and the policies of the eIDAS regulation. These digital certificates require a PSD2 authorization number be provided by a National Competent Authority (NCA) before the issuer can move forward.

The certificate is then created, and paired with a private key that is installed on a server (QWAC), HSM or other SCD. This prevents the key from being duplicated, stolen, or otherwise used maliciously. In the case of certificates provided by Sectigo on a SCD or QSCD, the keys are created and installed on the device by Sectigo.

Validation and Issuance - IMPORTANT

Getting Your PSD2 Certificate

After placing your order, you will be guided through the required validation checks before your certificate can be issued. Understanding these requirements in advance helps streamline the process and avoid delays.

Submitting Your CSR

When required, the Certificate Signing Request (CSR) is submitted at the time of order. A CSR is only necessary for QWACs or certificates that will be installed on an HSM or another secure device.

Once the order is placed, you will receive the Subscriber Agreement email. Follow the instructions in the email to agree to the agreement. After this the Complete Your eIDAS Request page is displayed, where you can monitor the progress of your order. The page shows all the steps that need to be completed for Sectigo to be able to issue your certificate.

Video ID Verification

The individual submitting the order must provide proof of identity.

Video ID verification is used to verify your identity. This requires completion of a Video ID session, and instructions for completing the process will be provided to you by Sectigo. Once the session is completed successfully, Sectigo can continue processing your certificate request.

Things you need:

A valid government-issued photo ID
A device with a working camera and microphone
A stable internet connection
Any instructions provided by Sectigo before the session

Email Verification

The email address provided with the order must be verified. You will receive a verification email with instructions to complete the process.

Signer Verification

When ordering on behalf of an organization, proof is required to confirm that the signer is an authorized representative.

As part of the verification, Sectigo verifies the phone number provided with the order. You will receive an email with instructions, and the process will involve a callback to the phone number that was verified as part of the organization identity.

The callback verifies the following:

The phone number is that of the organization.
The authenticity of the order and that it was placed by the organization.
The signature on the agreement is confirmed by the signer.
The authority of the signer to enter into an agreement.

Organization Validation

For orders involving legal persons, Sectigo will verify the physical, legal, and operational existence of the organization.

During the verification process, Sectigo reviews the organization details submitted with the order, including:

the legal identity and existence of the organization
the physical existence of the organization
the operational existence of the organization

You may be required to provide additional documentation and receive callbacks.

Second Approval

PSD2-compliant certificates require additional evidence confirming the organization's registration and approval by the relevant NCA (National Competent Authority).

Before you order

Sectigo PSD2 QWAC Certificates for legal persons are SSL/TLS certificates that are issued to organizations.

Organizations that are registered with and approved by their NCA, such as banking entities and third-party payment providers, can additionally obtain a PSD2-compliant QWAC.

QWACs (with or without PSD2) can additionally be ordered for multiple domains.

PSD2 Requirements

Generate your signing Key Pair and CSR on the server where you will be installing the certificate before ordering. Consult your server documentation.

These orders require that you provide a PSD2 authorization number as issued by your NCA.

Intended Use

PSD2 QWAC certificates are designed specifically for PSD2 and Open Banking use cases.

They are intended for communications between regulated financial institutions and Payment Service Providers and are not intended as general-purpose website authentication certificates.

Migration Guidance

Organizations currently using a PSD2 QWAC certificate for public website authentication should plan to migrate those use cases to a standard eIDAS QWAC certificate.

PSD2 QWAC certificates are intended for Open Banking and regulated financial communications rather than public website authentication. This guidance is consistent with current product direction and upcoming industry trust model changes.

FAQ

Can I use a PSD2 QWAC to secure my public website?

PSD2 QWAC certificates are intended for PSD2/Open Banking communications and are not intended for general-purpose website authentication. Organizations requiring website authentication should use a standard eIDAS QWAC certificate.