Policy Context and Legal Framework

The project was launched in the context of the IDA/IDABC programmes (http://ec.europa.eu/idabc) to facilitate interoperability with eCertificates of civil servants in national public administrations that participate in European Commission projects.

Implementation and Management Approach

A feasibility study examined the policy, organisational and technical issues for the establishment of an intermediate trust infrastructure between the Certification Authorities (CAs) used by the Member States' public administrations.

It addressed the main policy issues, the equivalence of certificate policies, provided model technical architectures, discussed the organisation and governance of the bridge CA, and the requirements for interoperability. To achieve this, meetings were conducted with voluntary Member States that had already set up certification services for their national public administrations or are well advanced in their planning in this area.

One of the recommendations of the feasibility study was that trust relationships could be established by the distribution of CTLs (certificate trust lists) electronically signed by a bridge CA.

A pilot was carried out to provide a proof of concept. This pilot demonstrated that a bridge was technically feasible.

Technology solution

The Certificate Authorities (CAs) are included in a TSL scheme according to standards as the TS 101.456 (Policy Requirements for CAs issuing Qualified Certificates) and TS 102.042 (Policy Requirements for CAs issuing Public Key Certificates). The pilot also analysed the expected standardisation by ETSI itself, APEC, the US Federal Bridge PKI as well as ISO committees.

Impact

Implementing a bridge only for European national public administrations would be a first step to create a practical solution to guarantee cross-border recognition of electronic signatures for general purposes.

Lessons learnt

-It is technologically possible to implement a bridge among certification authorities for cross border purposes, using the principle of Trust List (TSL).

-At the moment of finalising the pilot, no e-mail client nor SSL-browser supported TSL, therefore manual intervention is required to set-up a working system

-Further to the technical possibilities, an organisational and governance model has to be established in order to effectively implement a gateway among cross-border certification authorities.