Saatja: Olivier DELOS <
[email protected]>
Saatmisaeg: 27. juuli 2016. a. 2:04
Adressaat: Anne Tuisk
Koopia:
[email protected]
Teema: Fwd: Issues with EE trusted list Sn31
Dear Anne Tuisk,
Following the out of office message response from Henry, this email is copied to you as both
Henry and Erika are out of office.
Best regards
Olivier Delos
-------- Message transf�r� --------
Suje
t :
Issu
es
with
EE
trust
ed
list
Sn3
1
Date
:
Wed
, 27
Jul
2016
00:5
2:23
+02
00
De :
Oliv
ier
DEL
OS
<oli
vier.
delo
s@s
eale
d.be
>
Pou
r :
info
@tja
.ee,
henr
y.sar
apuu
@tja
.ee,
erika
.ada
ms
@tja
.ee
Cop
ie
? :
EC-
TL-
Serv
ice
@ec
.eur
opa.
eu
<EC
-TL-
Serv
ice
@ec
.eur
opa.
eu>
Dear EE TLSO,
Dear Erika,
Dear Henry,
When analysing the currently published EE trusted list Sn31, we identified the following issues :
1. The �O=� attribute value of the two notified EE TLSO certificates (i.e. "Estonian
Technical Surveillance Authority") does not match the TLSO "en" name in the TL (i.e.
"Estonian Technical Regulatory Authority") that is also the one notified to the EC and
appearing in the LOTL. Either you need to reissue and notify the EC at least two new
compliant certificates (proper option) or alternatively you can add that �O=� attribute
value to the TLSO names in your trusted list and notify the EC with the three values:
o "en": Estonian Technical Surveillance Authority
o "en": Estonian Technical Regulatory Authority
o "et": Tehnilise J�relevalve Amet
2. The "Siu" links ("en": https://sr.riik.ee/en/tsl/estonia.html and "ee":
http://sr.riik.ee/et/tsl/eesti.html) lead to a page where the information required as per CID
2015/1505/EU is not entirely present. See the TLSO eIDAS transition FAQ on the subject
for guidance.
3. The content of the page http://uri.etsi.org/TrstSvc/TrustedList/schemerules/EE/ should be
updated as well.
4. The content of the .sha2 companion file (i.e.
77fe6547478ba9c2396e74b02d17a09e4dc02cb1af3575412c651c936fa1b430) of the
signed XML machine processable version of the EE TL (https://sr.riik.ee/tsl/estonian-
tsl.sha2) does not match with the expected value computed from either the ETSI TLCC or
TLManager 5 (i.e.
d709853314da72da2626af0da0391488caf3037b63a230e9890e223955ad72b0).
5. TSP[1]-SVC[7] (KLASS3-SK: Qualified electronic seals): Only the additional service
information extension "for eSignature" should have been added to the current status
service and not the "for eSeal" Sie:aSI. The "for eSeal" value cannot be added as part of
the migration. Furthermore as all certificates issued by that service are to be considered as
"Not Qualified" from 1 July 2016 (See FAQ) it has no sense to add such a Sie:aSI "for
eSeals". See also below for the conditions to grant Sie:aSI "for eSeals" and a related
qualified status. Actually this service could even been withdrawn its qualified status for
that reason (with the current and mandatory Sie:Q extensions as per migration, all
certificates issued by that service are to be considered as not qualified). Another reason is
that the certificate is expired since 2012 !?
o --> delete Sie:aSI "for eSeals" extension in the current status part of that service.
6. TSP[1]-SVC[8] (KLASS3-SK 2010: Qualified electronic seals):
1. In the second history (the most recent one dated 2016-07-01 02:00:00), you must
1. Remove the Sie:aSI "for eSeals" as this cannot be part of the migration.
2. Remove the "Description" as they do not correspond to what the
extensions are expressing.
2. In the current status part, please consider what you are expressing:
1. You grant a qualified status for the issuance of QC for electronic
signatures (CA/QC + Sie:aSI "foreSignatures" + granted)
2. You grant a qualified status for the issuance of QC for electronic seals
(CA/QC + Sie:aSI "foreSeals" + granted) -- Note that you cannot do that
unless the TSP has completed the eIDAS Art.21 initiation phase (see
below).
3. You declare all certificates issued by the service and having the nR bit set
as qualified certificates for electronic seals (combination of QCStatement
and QcForESeal qualifiers)
4. Furthermore you declare all certificates issued by the service (having either
the nR bit set or not set) being declared as QC as certificate issued to Legal
Persons. This makes the Sie:aSI "for eSignatures" extension void of effect.
That latter should be removed.
o --> This means that you have granted a qualified status for the issuance of QC for
electronic seals to that service on the 1st of July (see below).
7. For the "OCSP, KLASS3-SK OCSP RESPONDER (from 2003)" service, you forgot to
add the Sie:aSI "for eSignatures". You added Sie:aSI "foreSeals" as part of the migration
which is not allowed.
8. For the "OCSP, KLASS3-SK OCSP RESPONDER (from 2006)" service, you added
Sie:aSI "foreSeals" as part of the migration which is not allowed.
9. For the "OCSP, KLASS3-SK OCSP RESPONDER 2009" service, you added Sie:aSI
"foreSeals" as part of the migration which is not allowed.
10. For the "OCSP, KLASS3-SK 2010 OCSP RESPONDER" service, you added Sie:aSI
"foreSeals" as part of the migration which is not allowed.
11. You have granted a qualified status for the issuance of qualified time stamps
"TSA/QTST" to the last listed service after migration but at 1 July 2016 and exactly at the
same time of the previous history. Note that you cannot do that unless the TSP has
completed the eIDAS Art.21 initiation phase (see below).
Hence it is noticed that compared to the situation before 1 July 2016, the first listed TSP (AS
Sertifitseerimiskeskus)
* has two of its listed CA/QC services that have been granted, as part of the migration or
right after (see above), a qualified status under Regulation 910/2014 for the issuance of
qualified certificates for electronic seals.
* has its "TSA/QTST" service that has been granted, right after the migration but at the
same time, a qualified status under Regulation 910/2014 for the issuance of qualified
electronic time stamps.
Since, as per Art.21.1 of the Regulation, granting such a qualified status is subject to a
notification and an audit from an accredited conformity assessment body (CAB) could you
please, for each of the three above mentioned services:
1. Confirm that AS Sertifitseerimiskeskus have properly notified you (the Estonian
Technical Regulatory Authority acting as EE supervisory body) together with a
conformity assessment report (CAR) issued by an CAB accredited under the
eIDAS Regulation?
2. Provide information on the notification format and procedure that you (meaning
the EE Supervisory Body) have established for such purposes?
3. Indicate which accredited CAB has conducted the audit and issued the CAR
required in Art.21.1 of the eIDAS Regulation?
4. Provide information about the national accreditation body (NAB) having
accredited the CAB and the eIDAS accreditation scheme used by that NAB?
5. Provide details about the structure and content of the conformity assessment report
they provided to you (meaning the EE Supervisory Body)?
6. Provide information about the verification procedures you adopted to grant the
qualified status on the basis of the notification and CAR provided to you (meaning
the EE Supervisory Body)?
Actually, CID (EU) 2015/1505 requires the "Siu" referred webpage to include information on the
national supervision system applicable to qualified and non-qualified trust service providers and
the qualified and non-qualified trust services they provide as regulated by Regulation (EU) No
910/2014. This specific information shall include, at least, for each underlying scheme listed
above:
* General description;
* Information about the process followed for the national supervision system and, when
applicable, for the approval under a national approval scheme.
* Information about the criteria against which trust service providers are supervised or,
where applicable, approved.
* Information about the criteria and rules used to select supervisors/auditors and defining
how they assess trust service providers and the trust services provided by them.
* When applicable, other contact and general information that applies to the scheme
operation.
The information provided on https://sr.riik.ee/en/tsl/estonia.html does not align with those
requirements.
Thanks a lot,
Best regards,
Olivier
P.S.: This message is sent to you on behalf of the European Commission (EC). In case of specific questions to the EC,
please contact:
[email protected]. The views expressed above are purely those of the writer and may
not in any circumstances be regarded as stating an official position of the EC. If you have received this message in
error, please contact the sender by e-mail or telephone and then delete this message. Thank you.