Information related to data on Member States' trusted lists as notified under Commission Implementing Decision (EU) 2015/1505

(2019/C 276/01)

Pursuant to Article 4(3) of Commission Implementing Decision (EU) 2015/1505 (1), the European Commission makes available to the public, through a secure channel to an authenticated web server, the information notified by Member States under Articles 4(1) and 4(2) of Implementing Decision (EU) 2015/1505, in a signed or sealed form suitable for automated processing.

The information provided below replaces the information published in OJ C 233, 28.6.2016, p. 1 on the same topic.

The information notified by Member States is compiled and made available as a signed or sealed XML machine-processable form, called the ‘list of trusted lists’ (hereafter the ‘LOTL’).

The authenticity and integrity of the LOTL shall be verified by relying parties prior to any use. The Commission accepts no responsibility or liability whatsoever regarding the content of the referenced national trusted lists which lies exclusively with the Member States.

The present publication details below where this LOTL is made available (hereafter the ‘LOTL location’) and which certificates support the signing/sealing of the LOTL (hereafter the ‘LOTL-signing certificates’). Further details on the mechanism in Section 2 can be found at https://ec.europa.eu/tools/lotl/pivot-lotl-explanation.html.

1. Initial state at the date of publication of the present document

At the date of publication of the present document, the following applies:

— The LOTL location is the following URL: https://ec.europa.eu/tools/lotl/eu-lotl.xml. Since 1 July 2016 and in line with the applicable legal framework, the publication is ensured only in a machine-processable form.

— The authenticity and integrity of the LOTL are ensured through an electronic signature (or electronic seal when applicable) supported by one of the LOTL-signing certificates represented in PEM format (‘Privacy-Enhanced Mail’ file format) in the Annex, and that can be authenticated using the following digest information: 1. Digest values for the first certificate: — SHA-256 digest (hexadecimal) value: 54 00 ab 71 2c 41 aa f0 c4 0b 50 5e 26 4d 54 94 d8 af 41 80 f8 f6 29 55 d1 62 23 b3 29 0f 97 c3 — SHA-1 digest (hexadecimal) value: 4b 9d d1 8f 1f 2c d8 b0 5f 46 73 5d 4b 5c f8 6f 92 33 61 b4 — SHA-256 digest (Base64) value: VACrcSxBqvDEC1BeJk1UlNivQYD49ilV0WIjsykPl8M= — SHA-1 digest (Base64) value: S53Rjx8s2LBfRnNdS1z4b5IzYbQ= 2. Digest values for the second certificate: — SHA-256 digest (hexadecimal) value: 9c 1a 3b 64 6e af 13 23 98 ef 31 9e 41 c8 e7 ed 72 5b 64 d5 77 25 80 ae 12 5d 59 c0 f6 84 56 30 — SHA-1 digest (hexadecimal) value: 03 99 a2 f2 1e d2 0c a6 66 9f 98 53 aa 39 9b 76 9f b0 a7 cb — SHA-256 digest (Base64) value: nBo7ZG6vEyOY7zGeQcjn7XJbZNV3JYCuEl1ZwPaEVjA= — SHA-1 digest (Base64) value: A5mi8h7SDKZmn5hTqjmbdp+wp8s= 3. Digest values for the third certificate: — SHA-256 digest (hexadecimal) value: 59 a1 bf 29 0b 81 8b 17 7a d6 1a c4 b3 e6 dc dd d4 6d a6 d5 be 95 79 f8 56 4a de a6 f2 cf 07 3e — SHA-1 digest (hexadecimal) value: 5b 2b 35 c3 97 0e a0 aa f9 41 e7 32 6f 6c 84 c0 80 82 31 7a — SHA-256 digest (Base64) value: WaG/KQuBixd61hrEs+bc3dRtptW+lXn4VkrepvLPBz4= — SHA-1 digest (Base64) value: Wys1w5cOoKr5Qecyb2yEwICCMXo= 4. Digest values for the fourth certificate: — SHA-256 digest (hexadecimal) value: 8e 50 8f 03 b1 32 50 0c 34 03 db 66 e9 dd 39 cd 78 f4 65 7c 84 09 58 a7 7d 34 e7 bd 62 14 68 e7 — SHA-1 digest (hexadecimal) value: d8 d6 e4 17 a8 ee 03 f2 ad dd 12 6c 89 e1 53 30 0b 14 fc b6 — SHA-256 digest (Base64) value: jlCPA7EyUAw0A9tm6d05zXj0ZXyECVinfTTnvWIUaOc= — SHA-1 digest (Base64) value: 2NbkF6juA/Kt3RJsieFTMAsU/LY= 5. Digest values for the fifth certificate: — SHA-256 digest (hexadecimal) value: c1 a3 7d b4 8c d5 e0 47 9b 97 f4 de 32 e3 a7 47 0c 52 aa fb 94 c1 65 6e f5 6f 97 50 39 92 c8 a7 — SHA-1 digest (hexadecimal) value: e6 c6 95 d1 d4 ff 78 b9 a2 3e c0 4c 6c f6 fd 59 47 54 86 af — SHA-256 digest (Base64) value: waN9tIzV4Eebl/TeMuOnRwxSqvuUwWVu9W+XUDmSyKc= — SHA-1 digest (Base64) value: 5saV0dT/eLmiPsBMbPb9WUdUhq8= 6. Digest values for the sixth certificate: — SHA-256 digest (hexadecimal) value: d2 06 4f dd 70 f6 98 2d cc 51 6b 86 d9 d5 c5 6a ea 93 94 17 c6 24 b2 e4 78 c0 b2 9d e5 4f 84 74 — SHA-1 digest (hexadecimal) value: d3 96 04 55 fe fb 23 c3 b6 c3 6c 2d 4b 92 10 57 54 9b 4e 43 — SHA-256 digest (Base64) value: 0gZP3XD2mC3MUWuG2dXFauqTlBfGJLLkeMCyneVPhHQ= — SHA-1 digest (Base64) value: 05YEVf77I8O2w2wtS5IQV1SbTkM= 7. Digest values for the seventh certificate: — SHA-256 digest (hexadecimal) value: 43 55 04 bf d8 02 ed f4 db 08 cb d7 c7 72 9a 0d 45 b2 27 79 7b 72 7e 4e 6e a1 d3 16 84 16 63 42 — SHA-1 digest (hexadecimal) value: 34 82 04 ff 61 30 66 82 95 8d 44 12 40 a0 30 35 54 15 44 94 — SHA-256 digest (Base64) value: Q1UEv9gC7fTbCMvXx3KaDUWyJ3l7cn5ObqHTFoQWY0I= — SHA-1 digest (Base64) value: NIIE/2EwZoKVjUQSQKAwNVQVRJQ= 8. Digest values for the eighth certificate: — SHA-256 digest (hexadecimal) value: cc d8 79 b3 6b b5 53 68 5b ec bd 12 90 1c 7f 41 f7 bd 3e 07 f8 98 fc bb e1 ee c4 56 b0 3d 75 89 — SHA-1 digest (hexadecimal) value: 19 a2 1c 40 1a 4a 27 f1 df 3d 5c 8e 1e 7f af 2e e5 44 da 1b — SHA-256 digest (Base64) value: zNh5s2u1U2hb7L0SkBx/Qfe9Pgf4mPy74e7EVrA9dYk= — SHA-1 digest (Base64) value: GaIcQBpKJ/HfPVyOHn+vLuVE2hs=

The authenticity and integrity of the LOTL should be verified by relying parties prior to any use. The Commission accepts no responsibility or liability whatsoever with regard to the content of the pointed national trusted lists which lies exclusively with the Member States.

2. Future change(s) of the LOTL location or LOTL-signing certificates

2.1. Introduction

From the date of publication of the present information, the LOTL shall include:

— The LOTL location together with the PEM representation of the LOTL-signing certificates as provided in the Annex.

— As the first part of the information regarding the underlying scheme (i.e. the ‘<SchemeInformationURI>’), in reverse chronological order – that is, showing the most recent publication first – the list of: — zero or more URLs where the archived preceding pivot LOTLs are published, back until and followed by — the URL of the latest relevant publication in the Official Journal of the European Union related to the LOTL.

2.2. Standard procedure

A future change to the LOTL location or the LOTL-signing certificates shall be reflected in the publication of a new instance of the LOTL which will include a new LOTL location or a modified set of LOTL-signing certificates for relying parties to use when authenticating the LOTL. Such a new instance of the LOTL announcing a new LOTL location or LOTL-signing certificates is hereafter referred to as a ‘pivot LOTL’, as it represents a pivot point in the historical values of the LOTL location and the LOTL-signing certificates. A pivot LOTL can announce a change in the LOTL location, a change of the LOTL-signing certificates, or both.

Starting at the date of issuance of a pivot LOTL in which this new information is first published, the LOTL location and LOTL-signing certificates may be used by relying parties to locate and authenticate the LOTL in replacement of the formerly issued LOTL location and LOTL-signing certificates. The European Commission will also ensure that the formerly issued LOTL location and LOTL-signing certificates can still be used to locate and authenticate the LOTL until 15 days after the issuance of the pivot LOTL announcing the new LOTL location or LOTL-signing certificates. This provides a transition period for relying parties to consume the new information at their most convenient time within this period.

2.3. Exceptional procedure

As an alternative to the mechanism explained in section ‘2.2. Standard procedure’, a new publication in the Official Journal of the European Union by the European Commission may however abruptly change the LOTL location, the LOTL-signing certificates, or the duration of the transition period, for instance as a temporary response to an emergency situation requiring the immediate replacement of all LOTL-signing certificates.

(1) Commission Implementing Decision (EU) 2015/1505 (4) of 8 September 2015 laying down technical specifications and formats relating to trusted lists pursuant to Article 22(5) of Regulation (EU) No 910/2014 of the European Parliament and of the Council on electronic identification and trust services for electronic transactions in the internal market (OJ L 235, 9.9.2015, p. 26).