The Regulation (EU) N°910/2014 on electronic identification and trust services for electronic transactions in the internal market (eIDAS Regulation), adopted on 23 July 2014, extended the scope of the Directive 1999/93/EC on a Community framework for electronic signatures (eSignatures Directive), by introducing in the legal framework provisions for new types of trust services. Additionally to services related to electronic signatures, the new trust services covered in the eIDAS Regulation are those related to electronic seals, electronic time stamps, electronic registered delivery services and certificates for website authentication. The eSignatures Directive introduced as well in the EU market a clarified regulatory context for electronic signatures by setting in place the qualification scheme. The eIDAS Regulation also broadens the scope of this framework, by establishing the possibility to become qualified for the new types of trust services. In this respect, the aim of the Regulation is to enhance consumer's trust in the digital environment and to improve the trust services market's transparency by introducing a clarified and comprehensive legal framework. The eIDAS Regulation provisions for trust services will enter into force on July 2016. To support its successful introduction in the market, this study focuses on one of the newly introduced services, qualified certificates for website authentication. Certificates for website authentication, widely known as SSL/TLS certificates, play a critical role in the security of online transactions and have been long employed by websites (it is estimated that currently 64.5% use presently some kind of certificates). This number has grown sharply in the last years driven by business needs rather than any regulatory framework, and the market has evolved to be highly concentrated in a small number of players, mostly from outside Europe. Based on these features, qualified certificates for website authentication (QWAC certificates) present a particular case among the new trust services defined in the eIDAS Regulation. They will need to enter in an already mature, global and unregulated market. For their successful introduction, it will be necessary to create a demand by properly communicating to consumers their benefits, while at the same time supporting providers to ensure enough supply. In this context, the objective of this report, carried out under ENISA Work Programme 2015, is to make recommendations on strategies for the successful introduction in the European market of qualified certificates for website authentication.
