Scope
On the request of GlobalSign NV/SA (hereafter referred to as: GlobalSign), the certification audit on all areas and processes was performed by BSI Group The Netherlands B.V. (John M. Keynesplein 9, 1066 EP Amsterdam, The Netherlands).
The audit covered all applicable requirements from the audit criteria listed below (see “Audit Information”) and are defined in GlobalSign’s Statement of Applicability, dated 6 May 2025 and the Overview of Applicability 2025.
The scope of the assessment comprised the following Trust Service Provider component services:
-,,Registration Service;
-,,Certificate Generation Service;
-,,Dissemination Service;
-,,Revocation Management Service;
-,,Revocation Status Service;
-,,Subject Device Provision Service;
This includes operating a remote QSCD / SCDev, where electronic signature creation data is generated and managed on behalf of the signatory.
These TSP component services are being provided for the following qualified trust service(s) as defined in Regulation (EU) 910/2014 (eIDAS):
-,,Issuance of qualified certificates for electronic signatures (qualified trust service), in accordance with the policies: QCP-n, QCP-n-qscd
-,,Issuance of qualified certificates for electronic seals (qualified trust service), in accordance with the policy: QCP-l, QCP-l-qscd
-,,Issuance of qualified certificates for website authentication (qualified trust service), in accordance with policies QEVCP-w, QCP-w-psd2;
In providing the (qualified) trust services, the TSP shares resources as coordinated by its parent company GMO GlobalSign Holdings K.K. in Japan. This includes providing and maintaining trust service component services, with the relevant operations, procedures, IT-infrastructure and applications.
The PKI component activities take place at different locations and are all performed by GMO GlobalSign group companies, under supervision of the TSP's Policy Authority and Governance & Compliance:
-,,Belgium, Leuven (Policy Authority, Governance & Compliance)
-,,UK, London (Office, software development, IT operations)
-,,UK, London (Datacenter for Certificate Generation Service and Registration/Revocation Management Service production systems)
-,,UK, Maidstone (Office: Registration/Revocation Management Service operations, support processes)
-,,Singapore (Office: Key management and Cryptographic controls)
-,,Singapore (Datacenter for Certificate Generation Service, Certificate Status Service production systems)
-,,Japan, Tokyo (Office: software development, IT operations, Governance & Compliance)
-,,Japan, Tokyo (Datacenter for Registration/Revocation Management Service production systems)
-,,India, New Delhi (Office: Registration/Revocation Management Service operations, support processes)
-,,Philippines, Makati City (Office: Registration/Revocation Management Service operations, support processes)
The certificates are issued through the issuing certification authorities, as specified below:
-,,GlobalSign Atlas E45 Qualified Remote Signing CA 2020
Sha256 Fingerprint:
5CB0FDEF052BD18A0A40ADA2235F46EB42B6D0993ED5A50DE47E3EA12FF191B1
+,,Qualified certificates for electronic signatures, QCP-n
+,,Qualified certificates for electronic seals, QCP-l
-,,GlobalSign Atlas R45 Qualified Remote Signing CA 2020
Sha256 Fingerprint:
323F35F0DFB01D6B478C24026C66852AAD3E96DCB1C5BE17C1DA1EC47D77CC87
+,,Qualified certificates for electronic signatures, QCP-n
+,,Qualified certificates for electronic seals, QCP-l
-,,GlobalSign Atlas R45 Remote QSCD Delegated RA CA 2022
Sha256 Fingerprint:
AD304215A70BF5D06E84973BF49862F10CFF490DA9C97D1D6FA6934F8E3C98AF
+,,Qualified certificates for electronic signatures, QCP-n-qscd
+,,Qualified certificates for electronic seals, QCP-l-qscd
-,,GlobalSign GCC E45 Qualified Signing CA 2020
Sha256 Fingerprint:
35E9429CDE680D8D5311CDD46FAEF0AEE694B0556C3D69C4F670E243D64C87FE
+,,Qualified certificates for electronic signatures, QCP-n
+,,Qualified certificates for electronic seals, QCP-l
-,,GlobalSign GCC R45 Qualified Signing CA 2020
Sha256 Fingerprint:
4E1474CFEB41D048C7E1E2C975D69AD3FD739BD44577A80D0432F233D51C5C77
+,,Qualified certificates for electronic signatures, QCP-n
+,,Qualified certificates for electronic seals, QCP-l
-,,GlobalSign GCC E45 Qualified QSCD Signing CA 2020
Sha256 Fingerprint:
8115E2CB4F04E56EA70EA932D0622831DD53B22BF6A93B3ACD9125FAB0374AF1
+,,Qualified certificates for electronic signatures, QCP-n-qscd
+,,Qualified certificates for electronic seals, QCP-l-qscd
-,,GlobalSign GCC R45 Qualified QSCD Signing CA 2020
Sha256 Fingerprint:
1B728D4A76506634A11007912F1D8C6B9AA39BE1AFCA49096657CF1FFB4513BF
+,,Qualified certificates for electronic signatures, QCP-n-qscd
+,,Qualified certificates for electronic seals, QCP-l-qscd
-,,GlobalSign GCC R3 EV QWAC CA 2020
Sha256 Fingerprint:
D4A5941C7141ED1949A0C6CE9DD45A0AB94DC337902EB0A1209852738EEBE854
+,,Qualified certificates for website authentication, QEVCP-w, QCP-w-psd2
-,,GlobalSign GCC R46 EV QWAC CA 2025
Sha256 Fingerprint:
C12FE52A74D33B88439FEAFBDCE47EAEEB881A3CA42078FDF13C0FF4E39B8161
+,,Qualified certificates for website authentication, QEVCP-w, QCP-w-psd2
The TSP component services are documented in the following Certification Practice Statements:
-,,GlobalSign Certificate Policy, version 7.5, 7 March 2025
-,,GlobalSign Certification Practice Statement, version 10.5, 7 March 2025
-,,GlobalSign PKI Disclosure Statement, version 2.1, 7 March 2025
-,,GlobalSign Qualified Signing Service Practice Statement, version 1.1, 7 March 2025
Our certification audit was performed in February, March and April 2025. The result of the audit is that we conclude, based on the objective evidence collected during the certification audit from 1 April 2024 through 31 March 2025, the areas assessed during the audit for the:
-,,Issuance of qualified certificates for electronic signatures (qualified trust service), in accordance with the policies: QCP-n, QCP-n-qscd
-,,Issuance of qualified certificates for electronic seals (qualified trust service), in accordance with the policy: QCP-l, QCP-l-qscd
-,,Issuance of qualified certificates for website authentication (qualified trust service), in accordance with policies QEVCP-w, QCP-w-psd2
were generally found to be effective, based on the applicable requirements defined in GlobalSign’s Statement of Applicability, dated 6 May 2025 and the Overview of Applicability 2025.
Audit information:
Audit criteria
-,,Regulation (EU) N 910/2014 of the European Parliament and of the Council on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC, Chapter III – Trust Services (as amended by Regulation .(EU) 2024/1183)
-,,ETSI EN 319 411-2 v2.5.1 (2023-10) Electronic Signatures and Infrastructures (ESI) - Policy and security requirements for Trust Service Providers issuing certificates;- Part 2: Requirements for trust service providers issuing EU qualified certificates, for the policies: QCP-n, QCP-n-qscd, QCP-l, QCP-l-qscd, QEVCP-w
-,,Supplemental to ETSI EN 319411-2:
-,,ETSI EN 319 401 v3.1.1 (2024-06) General Policy Requirements for Trust Service Providers;
-,,ETSI EN 319 411-1 v1.4.1 (2023-10) Electronic Signatures and Infrastructures (ESI) - Policy and security requirements for Trust Service Providers issuing certificates - Part 1: General requirements, for the policies: LCP, NCP, NCP+, PTC, EVCP;
-,,ETSI TS 119 495 v1.7.1 (2024-07) - Electronic Signatures and Infrastructures (ESI); Sector Specific Requirements; Certificate Profiles and TSP Policy Requirements for Open Banking, for the policies: QCP-l-qscd, QEVCP-w, QCP-w-psd2.
Audit Period of Time:
1 April 2024 through 31 March 2025
Audit performed:
February, March and April 2025
Scope
On the request of GlobalSign NV/SA (hereafter referred to as: GlobalSign), the certification audit on all areas and processes was performed by BSI Group The Netherlands B.V. (John M. Keynesplein 9, 1066 EP Amsterdam, The Netherlands).
The audit covered all applicable requirements from the audit criteria listed below (see “Audit Information”) and are defined in GlobalSign’s Statement of Applicability, dated 6 May 2025 and the Overview of Applicability 2025.
The scope of the assessment comprised the following Trust Service Provider component services:
-,,Time-stamping provision: This service component generates time-stamps.
-,,Time-stamping management: This service component monitors and controls the operation of the time-stamping services to ensure that the service provided is as specified by the TSA.
These TSP component services are being provided for the following qualified trust service as defined in Regulation (EU) 910/2014 (eIDAS):
-,,Issuance of qualified electronic time-stamps (qualified trust service)
In providing the (qualified) trust services, the TSP shares resources as coordinated by its parent company GMO GlobalSign Holdings K.K. in Japan. This includes providing and maintaining trust service component services, with the relevant operations, procedures, IT-infrastructure and applications.
The TSA component activities take place at different locations and are all performed by GMO GlobalSign companies, under supervision of the TSP's Policy Authority and Governance & Compliance:
-,,Belgium, Leuven (Policy Authority, Governance & Compliance)
-,,UK, London (Office, software development, IT operations)
-,,UK, London (Datacenter for Time-stamping provision and Time-stamping management production systems)
-,,Singapore (Office: Key management and Cryptographic controls)
Qualified Time-Stamps are issued by Time-Stamping Units (TSU) specified below:
Issuing CA: GlobalSign Atlas R45 Qualified Timestamping CA 2020
Sha256 Fingerprint:
D86E6264D58E4CA78AF419740D8186EA8EC48F0C33B4B4D7CA027931D627B1C8
-,,TSU: GlobalSign Qualified Time Stamping 2023 TSU-01.001-LCY
Sha256 Fingerprint:
3BC6E08C7B9D69E0A2638DE4093546FC11F2E4B0A9DB8474F67C7B4075367F93
-,,TSU: GlobalSign Qualified Time Stamping 2023 TSU-02.001-LCY
Sha256 Fingerprint:
73DA2A5C7F1B7740A494C71461C66DC688B18915674F280D562E41CA63AE6140
-,,TSU: GlobalSign Qualified Time Stamping 2023 TSU-03.001-LCY
Sha256 Fingerprint:
CA6821D8F40697772A80608A650AB6F1DF9CA4A8A361886395AEC96A12160027
-,,TSU: GlobalSign Qualified Time Stamping 2024 TSU-01.001-LCY
Sha256 Fingerprint:
FA707F690A1401270EE108B48B067FE7E44D6811BE997CB0D61AE0BC27985022
-,,TSU: GlobalSign Qualified Time Stamping 2024 TSU-02.001-LCY
Sha256 Fingerprint:
B9F37E026294E023F43FB36E69C1608578193D45C88EABA9E310A8B6C7B715D0
-,,TSU: GlobalSign Qualified Time Stamping 2024 TSU-03.001-LCY
Sha256 Fingerprint:
2B3752151E2317CF9EDD03B0BB96BD3D6C26D125843B4C29047D101885EB7ACD
-,,TSU: GlobalSign Qualified Time Stamping 2025 TSU-01.001-LCY
Sha256 Fingerprint:
374D6F038D5E8EDC52821103069174BAA3AF748CB141B7E41535C554AD376D6A
-,,TSU: GlobalSign Qualified Time Stamping 2025 TSU-02.001-LCY
Sha256 Fingerprint:
61DC3DBDD4F92E8DD6E9DEF69F30FA511D78E157EE80E88728DDF6F617D61A18
-,,TSU: GlobalSign Qualified Time Stamping 2025 TSU-03.001-LCY
Sha256 Fingerprint:
2E2E83347D5876D6C586BA1ED21BC59A9F34FF88D204D97A11C94F133A7E56B7
Issuing CA: GlobalSign Atlas R45 Qualified Timestamping CA 2024
Sha256 Fingerprint:
984721239B82A5630CDECA98C0AD5B384FFB0E9DFF6767A0390510982AAA1AFB
-,,TSU: GlobalSign Qualified Time Stamping 2024 TSU-01.002-LCY
Sha256 Fingerprint:
0028F24E14A2929F581ABE61D267D882026C04C81A664114D4340E33B14C3F80
-,,TSU: GlobalSign Qualified Time Stamping 2024 TSU-02.002-LCY
Sha256 Fingerprint:
5CA3C8D512D77137476DB1B60441A83652A8B1C6CE665245A17D446C95B5801C
-,,TSU: GlobalSign Qualified Time Stamping 2024 TSU-03.002-LCY
Sha256 Fingerprint:
16F5C2D4045C9C55C8545C66ABF85BD0D2607FD233D9CC785258581C5B43F90F
-,,TSU: GlobalSign Qualified Time Stamping 2025 TSU-01.002-LCY
Sha256 Fingerprint:
9F6EACEA5F2BD4C3135CBE6C6FE2FF823EC5F53DEE1DECDDA36704763B066D70
-,,TSU: GlobalSign Qualified Time Stamping 2025 TSU-02.002-LCY
Sha256 Fingerprint:
3E07E3FD18752D47E6085365F3AD6DB18B8AF8CC2DDF59782B09D1F8C5BA5646
-,,TSU: GlobalSign Qualified Time Stamping 2025 TSU-03.002-LCY
Sha256 Fingerprint:
53F67F641DEFD3B4DBF88838D3C1C196E9607D91B4365F1093FB8201894180BF
Other issuing CAs capable of issuing public key certificates for Time-Stamping Units (TSU) issuing Qualified Time-Stamps are:
-,,Issuing CA: GlobalSign Qualified Time Stamping CA 2019
Sha256 Fingerprint:
74ABE5E5CCEB75491FF72C4CF325405D8ADBFE390E189CF430BA60E62798878E
-,,Issuing CA: GlobalSign Atlas E46 Qualified Timestamping CA 2022
Sha256 Fingerprint:
FE0FC91A867975373ED2872CB3BD3DB708256D7C3A978486AF001CC008C1EBCC
The TSP component services are documented in the following GlobalSign Timestamping Practice Statement:
-,,GlobalSign Timestamping Practice Statement, version 1.1, 24 March 2025
Our certification audit was performed in February, March and April 2025. The result of the audit is that we conclude, based on the objective evidence collected during the certification audit from 1 April 2024 through 31 March 2025, the areas assessed during the audit for the issuance of qualified electronic time stamps (qualified trust service), were generally found to be effective, based on the applicable requirements defined in GlobalSign’s Statement of Applicability, dated 6 May 2025 and the Overview of Applicability 2025.
Audit information:
Audit criteria
-,,Regulation (EU) N 910/2014 of the European Parliament and of the Council on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC, Chapter III – Trust Services (as amended by Regulation .(EU) 2024/1183)
-,,ETSI EN 319 421 v1.2.1 (2023-05) Electronic Signatures and Infrastructures (ESI); Policy and Security Requirements for Trust Service Providers issuing Time-Stamps.
-,,Supplemental to ETSI EN 319421:
-,,ETSI EN 319 401 v3.1.1 (2024-06) General Policy Requirements for Trust Service Providers.
Audit Period of Time:
1 April 2024 through 31 March 2025
Audit performed:
February, March and April 2025