These days I have seen magazine articles, blog posts and tweets complaining about article 45 of the #eIDAS2 regulation that is about to be approved in the Triloge process.

Almost all of them echo Mozilla’s statements about Article 45, announcing a hecatomb on the security of web browsing and claiming that it is the door that opens to governments the possibility of spying on citizens.

But how curious! No article or blog post includes the text of Article 45 of the future #eIDAS2 regulation to analyze it and explain why its ominous predictions can be deduced from the proposed text.

So the purpose of this blog post is precisely to include the text of article 45 of the future #eIDAS2 regulation so that anyone can analyze it on their own, without having to accept the arguments of one side or the other.

This is one of the latest versions used in the trilogues.

«Article 45

Requirements for qualified certificates for website authentication

1. Qualified certificates for website authentication shall allow the authentication and identification of the natural or legal person to whom the certificate was issued with a high level of assurance. Qualified certificates for website authentication shall also meet the requirements laid down in Annex IV. Qualified certificates for website authentication shall be deemed compliant with this paragraph and the requirements laid down in Annex IV where they meet the standards referred to in paragraph 3.
2. Qualified certificates for website authentication referred to in paragraph 1 shall be recognised by web-browsers. Web browsers shall not be prevented from taking measures that are both necessary and proportionate to address substantiated risks of breaches of security, user’s privacy and loss of integrity of certificates provided such measures are duly reasoned. In such a case, the web browser shall notify the Commission, ENISA and the qualified trust service provider that issued that certificate or set of certificates without delay of any measure taken. Such recognition means that web-browsers shall ensure that the relevant identity data and electronic attestation of attributes provided is displayed in a user friendly manner, where possible, consistent manner, that reflects the state-of-the-art regarding accessibility, user awareness and cybersecurity according to best industry standards. Web-browsers shall ensure support and interoperability with qualified certificates for website authentication referred to in paragraph 1, with the exception of enterprises, considered to be microenterprises and small enterprises in accordance with Commission Recommendation 2003/361/EC in the first 5 years of operating as providers of web-browsing services.
3. By … [12 months after the date of entry into force of this amending Regulation], the Commission shall, by means of implementing acts, provide the specifications and reference numbers of standards for qualified certificates for website authentication referred to in paragraph 1 and 2. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).»