EN Official Journal of the European Union C 233/1

Information related to data on Member States’ trusted lists as notified under Commission Decision 2009/767/EC, as amended by Decision 2010/425/EU and Implementing Decision 2013/662/EU and as notified under Implementing Decision (EU) 2015/1505

(2016/C 233/01)

Pursuant to Article 2.4 of Commission Decision 2009/767/EC (1), as amended by Decision 2010/425/EU (2) and Implementing Decision 2013/662/EU (3), in application until 1 July 2016, the European Commission makes available to the Member States, through a secure channel to an authenticated web server, the information notified by Member States under Article 2.3 of Decision 2009/767/EC as amended in a signed machine-processable form,

and

Pursuant to Article 4.3 of Commission Implementing Decision (EU) 2015/1505 (4), entering in application on 1 July 2016, the European Commission makes available to the public, through a secure channel to an authenticated web server, the information notified by Member States under Articles 4.1 and 4.2 of Implementing Decision (EU) 2015/1505, in a signed or sealed form suitable for automated processing.

The information provided below replaces the information published in OJ C 435 of 24 December 2015, page 1 on the same topic.

The information notified by Member States is available as a signed or sealed XML machine-processable form (hereafter the ‘compiled list’) at the following URL: https://ec.europa.eu/information_society/policy/esignature/trusted-list/tl-mp.xml

The authenticity and integrity of ‘the compiled list’ is ensured through an electronic signature (or electronic seal when applicable) supported by one of the following digital certificates that can be authenticated through the following digest information:

1. Digest value for the first certificate: — SHA-256 digest (Hex) value: 59 c8 0d cc 74 29 cc fd 8c 2b 15 90 fe 88 5f b4 f6 c7 7f 7c 9c bb 4b 82 a6 2c b1 c2 7f f4 e2 46 — SHA-1 digest (Hex) value: 4b 78 8c 05 93 2d 0c ea 88 f7 a8 4a 52 ce ca 04 ef 7c 93 73 — SHA-256 digest (Base64) value: WcgNzHQpzP2MKxWQ/ohftPbHf3ycu0uCpiyxwn/04kY= — SHA-1 digest (Base64) value: S3iMBZMtDOqI96hKUs7KBO98k3M

2. Digest value for the second certificate: — SHA-256 digest (Hex) value: f1 bc dd 11 7b 15 54 17 38 13 a4 21 83 c5 4d b9 7e 3a 7e 10 9d 0a fa 98 f4 bc d3 26 75 4a 03 51 — SHA-1 digest (Hex) value: d5 44 56 29 05 70 58 26 fd 1e 13 32 a3 3c 25 69 88 35 7a 3c — SHA-256 digest (Base64) value: 8bzdEXsVVBc4E6Qhg8VNuX46fhCdCvqY9LzTJnVKA1E= — SHA-1 digest (Base64) value: 1URWKQVwWCb9HhMyozwlaYg1ejw=

3. Digest value for the third certificate: — SHA-256 digest (Hex) value: ff ea 7f 0e d2 9b eb 07 73 ea 3b 0c 47 29 bb f8 00 a6 c3 90 b6 21 95 cb 27 0f 12 a4 aa 62 f2 84 — SHA-1 digest (Hex) value: 5e 9f a7 c8 73 6c 86 e3 86 64 ba 1a f0 d0 42 43 75 ee 5c 3c — SHA-256 digest (Base64) value: /+p/DtKb6wdz6jsMRym7+ACmw5C2IZXLJw8SpKpi8oQ= — SHA-1 digest (Base64) value: Xp+nyHNshuOGZLoa8NBCQ3XuXDw=

4. Digest value for the fourth certificate: — SHA-256 digest (Hex) value: f7 bc 0d 16 4d ec 8f 36 70 9a be 85 fc 57 02 2f 3b 16 84 70 0a 80 4c 36 8d 34 32 90 04 90 df cb — SHA-1 digest (Hex) value: 00 d2 05 3d e4 cb 4e 0e 3c 4a e3 d6 f4 01 24 95 8c 48 bf 6e — SHA-256 digest (Base64) value: 97wNFk3sjzZwmr6F/FcCLzsWhHAKgEw2jTQykASQ38s= — SHA-1 digest (Base64) value: ANIFPeTLTg48SuPW9AEklYxIv24=

The authenticity and integrity of the ‘compiled list’ should be verified by relying parties prior to any use. The Commission accepts no responsibility or liability whatsoever with regard to the content of the pointed national trusted lists which lies exclusively with the Member States.

From the date of publication of the present information the ‘compiled list’ shall include the URL of the ‘compiled list’ together with the PEM representation of the above digital certificates as provided in the Annex (hereafter the ‘secure pointer to the compiled list’).

Any future change in the ‘secure pointer to the compiled list’ shall likewise be reflected in the publication of a new instance of the ‘compiled list’ which will include a new URL or a modified set of digital certificates for relying parties to use when authenticating the ‘compiled list’.

Starting at the date of issuance of the ‘compiled list’ in which this new information is first published, this ‘secure pointer to the compiled list’ may be used by relying parties to locate and authenticate the ‘compiled list’ in replacement of the formerly issued ‘secure pointer to the compiled list’. The European Commission will also ensure that the formerly issued ‘secure pointer to the compiled list’ can still be used to locate and authenticate the ‘compiled list’ until 15 days after the publication of the new ‘secure pointer to the compiled list’. This provides a transition period for relying parties to consume the new information at their most convenient time within this period.

The duration of this transition period may however be abruptly changed by the European Commission in a new publication in the Official Journal of the European Union, for instance as a temporary response to an emergency situation requiring the immediate replacement of all the digital certificates of the ‘secure pointer to the compiled list’.

Each instance of the ‘compiled list’ shall include, as the first part of the information regarding the underlying scheme, in their chronological order showing the most recent element first, the list of:

— the URLs where the last archived previous instance of the compiled list containing a new ‘secure pointer to the compiled list’ is published, back until and followed by

— the URL of the latest relevant publication in the Official Journal of the European Union setting the ‘secure pointer to the compiled list’.

Until 30 June 2016, the information notified by Member States is also available in human-readable form at the following URL: https://ec.europa.eu/information_society/policy/esignature/trusted-list/tl-hr.pdf

As of 1 July 2016 and in line with the applicable legal framework, the publication will be ensured only in a machine-processable form.

(1) Commission Decision 2009/767/EC of 16 October 2009 setting out measures facilitating the use of procedures by electronic means through the ‘points of single contact’ under Directive 2006/123/EC of the European Parliament and of the Council on services in the internal market (OJ L 299, 14.11.2009, p. 18).

(2) Commission Decision 2010/425/EU of 28 July 2010 amending Decision 2009/767/EC as regards the establishment, maintenance and publication of trusted lists of certification service providers supervised/accredited by Member States (OJ L 199, 31.7.2010, p. 30).

(3) Commission Implementing Decision 2013/662/EU of 14 October 2013 amending Decision 2009/767/EC as regards the establishment, maintenance and publication of trusted lists of certification service providers supervised/accredited by Member States (OJ L 306, 16.11.2013, p. 21).

(4) Commission Implementing Decision (EU) 2015/1505 (4) of 8 September 2015 laying down technical specifications and formats relating to trusted lists pursuant to Article 22(5) of Regulation (EU) No 910/2014 of the European Parliament and of the Council on electronic identification and trust services for electronic transactions in the internal market (OJ L 235, 9.9.2015, p. 26).