natgillin/translations-raw huggingface dataset:
Insofar as there is no truly interoperable and cross-border profile for the QC, the required information might include other information than the ‘Service digital identity’ of a single (Root) CA, in particular information identifying the QC status of the issued certificate, and whether or not the supported signatures are created by an SSCD.
Če ni resnično interoperabilnega in čezmejnega profila za kvalificirana potrdila, lahko zahtevane informacije vključujejo tudi druge informacije, ki niso informacije o „Service digital identity“ posameznega (korenskega) CA, zlasti informacije, ki opredeljujejo status QC izdanega potrdila, ter podatek, ali so bili podprti podpisi oblikovani s SSCD.
The Body in a Member State that is designated to establish, edit and maintain the TL (i.e. the Scheme operator as per ETSI TS 102 231) must therefore take into account the current profile and certificate content in each issued QC, per CSPQC covered by the TL.
Organ v državi članici, ki je imenovan za vzpostavitev, urejanje in vzdrževanje zanesljivega seznama (tj. upravljavec sheme po ETSI TS 102 231), mora zato upoštevati trenutni profil in vsebino potrdila v vsakem izdanem kvalificiranem potrdilu, po overiteljih, ki izdajajo kvalificirana potrdila, vključenih v zanesljivi seznam.
Completing the ‘Service type identifier’ (Sti), ‘Service name’ (Sn), and ‘Service digital identity’ (Sdi) [12] fields with information provided in the ‘Service information extensions’ (Sie) field allows the proposed TL common template to fully determine a specific type of qualified certificate issued by a listed CSP certification service issuing QCs and to provide information about the fact that it is supported by an SSCD or not (when such information is missing in the issued QC).
Z vnašanjem informacij, navedenih v polju „Service information extensions“ („Sie“), v polja „Service type identifier“ („Sti“), „Service name“ („Sn“) in „Service digital identity“ („Sdi“) [12], omogoča predlaganemu skupnemu modelu zanesljivega seznama, da v celoti določi posebno vrsto kvalificiranega potrdila, ki ga je izdal na seznamu naveden overitelj, ki izdaja kvalificirana potrdila, in da zagotovi informacije o tem, ali je podprto s SSCD (če tega podatka ni v izdanem QC).
A specific ‘Service current status’ (Scs) information is of course associated to this entry.
S tem vnosom je seveda povezan poseben podatek o „Service current status“ („Scs“).
This is depicted in Figure 2 below.
To je prikazano v spodnji sliki 2.
Listing a service by just providing the ‘Sdi’ of a (Root) CA would mean that it is ensured (by the CSP issuing QCs but also by the Supervisory/Accreditation Body in charge of the supervision/accreditation of this CSP) that any end-entity certificate issued under this (Root) CA (hierarchy) contains enough ETSI defined and machine-processable information to assess whether or not it is a QC, and whether it is supported by an SSCD.
Navedba storitve zgolj z navedbo „Sdi“ (korenskega) CA bi pomenila, da je zagotovljeno (s strani overitelja, ki izdaja kvalificirana potrdila, in tudi s strani organa nadzora/akreditacije, ki je odgovoren za nadzor/akreditacijo tega overitelja), da vsako potrdilo končne entitete, izdano po tem (korenskem) CA (hierarhija), vsebuje dovolj s strani ETSI opredeljenih informacij, ki jih je mogoče strojno obdelati, da se oceni, ali gre za kvalificirano potrdilo in ali ga podpira SSCD.
In the event, for example, that the latter assertion is not true (e.g. there is no ETSI standardised machine-processable indication in the QC about whether it is supported by an SSCD), then by listing only the ‘Sdi’ of that (Root) CA, it can only be assumed that QCs issued under this (Root) CA hierarchy are not supported by any SSCD.
Če ta trditev ne drži (npr. kvalificirano potrdilo ne vsebuje s strani ETSI standardizirane navedbe, ki jo je mogoče strojno obdelati, o tem, da je podprto s SSCD), je mogoče zgolj z navedbo „Sdi“ tega (korenskega) CA domnevati samo, da kvalificirana potrdila, izdana po tej (korenski) CA hierarhiji, niso podprta s SSCD.
In order to consider those QCs as supported by an SSCD, the ‘Sie’ should be used to indicate this fact (this also indicates that it is guaranteed by the CSP issuing QCs and supervised/accredited by the Supervisory or Accreditation Body respectively).
Da se kvalificirana potrdila štejejo za podprta s SSCD, je treba za navedbo tega dejstva uporabiti „Sie“ (to tudi pomeni, da to potrjuje overitelj, ki izdaja kvalificirana potrdila in ga nadzoruje/akreditira organ nadzora oziroma akreditacije).
General principles — Editing rules — CSPQC entries (listed services)
Splošna načela – Pravila urejanja – CSPQC vnosi (navedene storitve)
Service entry for a Listed CSP issuing QCs in the TL implemented in TSL format
Vnos storitve za navedenega CSP, ki izdaja QC, v TL, izvedenem v formatu TSL
The present TL common template technical specifications allow using a combination of five main parts of information in the service entry:
Veljavne tehnične specifikacije za skupni model TL omogočajo uporabo kombinacije petih glavnih delov informacij v vnosu storitve:
The ‘Service type identifier’ (Sti), e.g. identifying a CA issuing QCs (CA/QC),
„Service type identifier“ („Sti“), npr. opredeljuje CA, ki izdaja QC („CA/QC“),
The ‘Service digital identity’ (Sdi) information identifying a listed service, e.g. the X.509v3 certificate (as a minimum) of a CA issuing QCs,
podatek „Service digital identity“ („Sdi“) opredeljuje navedeno storitev, npr. potrdilo X.509v3 (najmanj) za CA, ki izdaja QC,
For CA/QC services, optional ‘Service information extensions’ (Sie) information that shall allow inclusion of a sequence of one or more tuples, each tuple providing:
za storitve CA/QC, neobvezne informacije „Service information extensions“ („Sie“), ki omogočajo vključitev niza ene ali več terk, pri čemer vsaka terka nudi:
Criteria to be used to further identify (filter) under the ‘Sdi’ identified certification service that precise service (i.e. set of qualified certificates) for which additional information is required/provided with regard to the indication of the SSCD support (and/or issuance to a Legal Person); and
merila za nadaljnjo opredelitev (filter), po „Sdi“ opredeljeni storitvi overjanja, tiste storitve (tj. niz kvalificiranih potrdil), za katero se zahtevajo/zagotovijo dodatne informacije v zvezi z navedbo podpore SSCD (in/ali izdajo pravni osebi), in
The associated information (qualifiers) on whether this further identified service set of qualified certificates is supported by an SSCD or not or whether this associated information is part of the QC under a standardised machine-processable form, and/or information regarding the fact that such QCs are issued to Legal Persons (by default they are to be considered as issued only to Natural Persons);
povezane informacije („kvalifikatorji“) o tem, ali je ta nadalje opredeljeni niz kvalificiranih potrdil podprt s SSCD oziroma ali so te povezane informacije del QC po standardizirani obliki, ki jo je mogoče strojno obdelati, in/ali informacije v zvezi z dejstvom, da se takšna QC izdajo pravnim osebam (načeloma se šteje, da se izdajo samo fizičnim osebam).
The ‘current status’ information for this service entry providing information on:
Informacije o „trenutnem statusu“ za ta vnos storitve, ki zagotavljajo informacije:
Whether it is a supervised or accredited service, and
o tem, ali gre za nadzorovano ali akreditirano storitev, in
The supervision/accreditation status itself.
o samem statusu nadzora/akreditacije.
Editing and usage guidelines for CSPQC services entries
Smernice za urejanje in uporabo vnosov storitev CSPQC
The general editing guidelines are:
Splošne smernice za urejanje so:
If it is ensured (guarantee provided by CSPQC and supervised/accredited by Supervisory Body (SB)/Accreditation Body (AB)) that, for a listed service identified by a ‘Sdi’, any QC supported by an SSCD does contain the ETSI defined QcCompliance statement, and does contain the QcSSCD statement and/or QCP + Object Identifier (OID), then the use of an appropriate ‘Sdi’ is sufficient and the ‘Sie’ field can be used as an option and will not need to contain the SSCD support information.
Če je zagotovljeno (jamstvo, ki ga zagotovi CSPQC in nadzoruje/akreditira nadzorni organ (SB)/akreditacijski organ (AB)), da za navedeno storitev, opredeljeno s „Sdi“, vsako QC, podprto s SSCD, vsebuje s strani ETSI opredeljeno izjavo QcCompliance in izjavo QcSSCD in/ali identifikacijsko oznako (OID) QCP+, potem zadostuje uporaba ustreznega „Sdi“, polje „Sie“ pa se lahko uporabi kot možna izbira in ni nujno, da vsebuje informacije o podpori SSCD.
If it is ensured (guarantee provided by CSPQC and supervised/accredited by SB/AB) that, for a listed service identified by a ‘Sdi’, any QC not supported by an SSCD does contain either the QcCompliance statement and/or QCP OID, and it is such that it is meant to not contain the QcSSCD statement or QCP + OID, then the use of an appropriate ‘Sdi’ is sufficient and the ‘Sie’ field can be used as an option and will not need to contain the SSCD support information (meaning it is not supported by an SSCD)
Če je zagotovljeno (jamstvo, ki ga zagotovi CSPQC in nadzoruje/akreditira SB/AB), da za navedeno storitev, opredeljeno s „Sdi“, vsako QC, ki ni podprto s SSCD, vsebuje bodisi izjavo QcCompliance in/ali QCP OID in je takšno, da se šteje, da ne vsebuje izjave QcSSCD ali QCP+ OID, potem zadostuje uporaba ustreznega „Sdi“, polje „Sie“ pa se lahko uporabi kot možna izbira in ni nujno, da vsebuje informacije o podpori SSCD (kar pomeni, da ni podprto s SSCD).
If it is ensured (guarantee provided by CSPQC and supervised/accredited by SB/AB) that, for a listed service identified by a ‘Sdi’, any QC does contain the QcCompliance statement, and some of these QCs are meant to be supported by SSCDs and some not (e.g. this may be differentiated by different CSP specific Certificate Policy OIDs or through other CSP specific information in the QC, directly or indirectly, machine-processable or not), but it contains NEITHER the QcSSCD statement NOR the ETSI QCP(+) OID, then the use of an appropriate ‘Sdi’ may not be sufficient AND the Sie field must be used to indicate explicit SSCD support information together with a potential information extension to identify the covered set of certificates.
Če je zagotovljeno (jamstvo, ki ga zagotovi CSPQC in nadzoruje/akreditira SB/AB), da za navedeno storitev, opredeljeno s „Sdi“, vsako QC vsebuje izjavo QcCompliance, in da so nekatera od teh QC podprta s SSCD (npr. to se lahko razlikuje glede na različne OID politike potrdila, specifične za CSP, ali druge za CSP specifične informacije, neposredno ali posredno, z možnostjo strojne obdelave ali ne), vendar NE VSEBUJE niti izjave QcSSCD niti ETSI QCP(+) OID, potem uporaba ustreznega „Sdi“ ne zadostuje IN se v polje „Sie“ vnesejo izrecne informacije o podpori SSCD, skupaj z morebitno razširitvijo informacij, da se opredeli zajeti niz potrdil.
This is likely to require the inclusion of different ‘SSCD support information values’ for the same ‘Sdi’ when making use of the ‘Sie’ field.
To zelo verjetno zahteva vključitev različnih „vrednosti informacij o podpori SSCD“ za isti „Sdi“, če se uporablja polje „Sie“.
If it is ensured (guarantee provided by CSPQC and supervised/accredited by SB/AB) that for a listed service identified by a ‘Sdi’, any QC does not contain any of the QcCompliance statement, the QCP OID, the QcSSCD statement, or the QCP + OID but it is ensured that some of these end-entity certificates issued under this ‘Sdi’ are meant to be QCs and/or supported by SSCDs and some not (e.g. this may be differentiated by different CSPQC specific Certificate Policy OIDs or through other CSPQC specific information in the QC, directly or indirectly, machine-processable or not), then the use of an appropriate Sdi will not be sufficient AND the Sie field must be used to include explicit SSCD support information.
Če je zagotovljeno (jamstvo, ki ga zagotovi CSPQC in nadzoruje/akreditira SB/AB), da za navedeno storitev, opredeljeno s „Sdi“, QC ne vsebuje izjave QcCompliance, QCP OID, izjave QcSSCD ali QCP+ OID, vendar je zagotovljeno, da se nekatera izmed teh potrdil končnih entitet, izdana po tem „Sdi“, štejejo za QC in/ali kot podprta s SSCD (npr. to se lahko razlikuje glede na različne OID politike potrdila, specifične za CSPQC ali druge za CSPQC specifične informacije v QC, neposredno ali posredno, z možnostjo strojne obdelave ali ne), potem uporaba ustreznega „Sdi“ ne zadostuje IN je treba uporabiti polje „Sie“ za vključitev izrecnih informacij o podpori SSCD.
As a general default principle, for a listed CSP in the Trusted List there must be one service entry per single X.509v3 certificate for a CA/QC type certification service, i.e. a Certification Authority (directly) issuing QCs.
Načeloma mora za navedenega CSP na zanesljivem seznamu obstajati en vnos storitve za potrdilo X.509v3 za storitev overjanja CA/QC, tj. za overitelja potrdila (CA), ki (neposredno) izdaja QC.
In some carefully envisaged circumstances and carefully managed conditions, a Member State Supervisory Body/Accreditation Body may decide to use the X.509v3 certificate of a Root or Upper level CA (i.e. a Certification Authority not directly issuing end-entity QCs but certifying a hierarchy of CAs down to CAs issuing QCs to end-entities) as the Sdi of a single entry in the list of services from a listed CSP.
V nekaterih skrbno nadzorovanih okoliščinah in skrbno nadzorovanih pogojih se lahko nadzorni organ/akreditacijski organ države članice odloči za uporabo potrdila X.509v3 CA korenske ali višje ravni (tj. overitelja potrdila, ki ne izdaja QC neposredno končnim entitetam, temveč potrjuje hierarhijo CA vse do CA, ki izdajajo QC končnim entitetam) kot „Sdi“ posameznega vnosa na seznam storitev navedenega CSP.
The consequences (advantages and disadvantages) of using such X.509v3 Root CA or Upper CA as Sdi values of TL services entries must be carefully considered and endorsed by Member States.
Države članice morajo skrbno preučiti in potrditi posledice (prednosti in slabosti) uporabe takšnega potrdila X.509v3 korenskega CA ali višjega CA kot vrednosti „Sdi“ vnosov storitev na TL.
Moreover, when using this authorized exception to the default principle, Member State must provide the necessary documentation to facilitate certification path building and verification.
Poleg tega morajo države članice pri uporabi te dovoljene izjeme od splošnega načela zagotoviti potrebno dokumentacijo za pospešitev vzpostavitve in potrditve verige overjanja.
In order to illustrate the general editing guidelines, the following example can be given: In the context of a CSPQC using one Root CA under which several CAs are issuing QCs and non-QCs, but for which the QCs do contain only the QcCompliance statement and no indication of whether it is supported by an SSCD, listing the Root CA ‘Sdi’ only would mean, under the rules explained above, that any QC issued under this Root CA hierarchy is NOT supported by an SSCD.
Za ponazoritev splošnih smernic urejanja je mogoče podati naslednji primer: v okviru CSPQC, ki uporablja en korenski CA, po katerem več CA izdaja kvalificirana in nekvalificirana potrdila, vendar za katerega QC vsebujejo le izjavo QcCompliance in ne navajajo, ali so QC podprti s SSCD, bi zgolj navedba „Sdi“ korenskega CA pomenila, po zgoraj pojasnjenih pravilih, da QC, izdan po tej korenski hierarhiji CA, NI podprt s SSCD.
If those QCs are actually supported by an SSCD, it would be strongly recommended to make use of the QcSSCD statement in the QCs issued in the future.
Če so ta QC dejansko podprta s SSCD, se močno priporoča, da se v prihodnosti v QC uporabi izjava QcSSCD.
In the meantime (until the last QC not containing this information has expired), the TSL should make use of the Sie field and associated Qualifications extension, e.g. filtering certificates through specific CSPQC defined OID(s) potentially used by the CSPQC to distinguish between different types of QCs (some supported by an SSCD and some not) and including explicit ‘SSCD support information’ with regards to those filtered certificates through the use of ‘Qualifiers’.
Medtem (dokler ne poteče veljavnost zadnjega QC, ki ne vsebuje te informacije) pa mora TSL uporabljati polje „Sie“ in povezano razširitev „kvalifikacije“, npr. filtriranje potrdil s pomočjo posebnih OID, ki jih opredeli CSPQC in jih morebiti uporablja za razlikovanje med različnimi vrstami QC (nekateri so podprti s SSCD, drugi pa ne), in vključno z izrecnimi „informacijami o podpori SSCD“ v zvezi s temi filtriranimi potrdili s pomočjo „kvalifikatorjev“.
The general usage guidelines for electronic signature applications, services or products relying on a TSL implementation of a Trusted List according to the present Technical Specifications are as follows:
Splošne smernice za uporabo aplikacij, storitev ali proizvodov za elektronsko podpisovanje, ki temeljijo na izvajanju TSL zanesljivega seznama v skladu z zadevnimi tehničnimi specifikacijami, so naslednje:
A ‘CA/QC’‘Sti’ entry (similarly a CA/QC entry further qualified as being a RootCA/QC through the use of ‘Sie’ additionalServiceInformation extension)
Vnos „CA/QC“„Sti“ (podobno vnos CA/QC, ki je nadalje opredeljen kot „korenski CA/QC“ s pomočjo „Sie“ razširitve additionalServiceInformation)
indicates that from the ‘Sdi’ identified CA (similarly within the CA hierarchy starting from the ‘Sdi’ identified RootCA), all issued end-entity certificates are QCs provided that it is claimed as such in the certificate through the use of appropriate QcStatements (i.e. QcC, QcSSCD) and/or ETSI defined QCP(+) OIDs (and this is ensured by Supervisory/Accreditation Body, see above ‘general editing guidelines’)
pomeni, da so s strani „Sdi“ opredeljenega CA (podobno v hierarhiji CA, začenši s korenskim CA, opredeljenim s „Sdi“) vsa izdana potrdila končnim entitetam kvalificirana potrdila, pod pogojem, da je to navedeno v potrdilu s pomočjo ustreznih QcStatement (tj. QcC, QcSSCD) in/ali s strani ETSI opredeljenih QCP(+) OID (in to zagotavlja nadzorni/akreditacijski organ, glej zgornje „splošne smernice za urejanje“).
Note: if no ‘Sie’‘Qualification information’ is present or if an end-entity certificate that is claimed to be a QC is not ‘further identified’ through a related ‘Sie’ entry, then the ‘machine-processable’ information to be found in the QC is supervised/accredited to be accurate.
Opomba: če ni navedene informacije „Sie“„kvalifikacija“ ali če potrdilo končne entitete, ki naj bi bilo QC, ni „nadalje opredeljeno“ s povezanim vnosom „Sie“, se točnost informacij v QC, „ki jih je mogoče strojno obdelati“, nadzoruje/akreditira.
That means that the usage (or not) of the appropriate QcStatements (i.e. QcC, QcSSCD) and/or ETSI defined QCP(+) OIDs is ensured to be in accordance with what it is claimed by the CSPQC.
To pomeni, da je uporaba (ali neuporaba) ustreznih QcStatement (tj. QcC, QcSSCD) in/ali s strani ETSI opredeljenih QCP(+) OID zagotovo v skladu s podatki, ki jih navaja CSPQC,
and IF‘Sie’‘Qualification’ information is present, then in addition to the above default usage interpretation rule, those certificates that are identified through the use of this ‘Sie’‘Qualification’ entry, which is constructed on the principle of a sequence of ‘filters’ further identifying a set of certificates and providing some additional information regarding ‘SSCD support’ and/or ‘Legal person as subject’ (e.g. those certificates containing a specific OID in the Certificate Policy extension, and/or having a specific ‘Key usage’ pattern, and/or filtered through the use of a specific value to appear in one specific certificate field or extension, etc.), are to be considered according to the following set of ‘qualifiers’, compensating for the lack of information in the corresponding QC, i.e.:
in ČE je navedena informacija „Sie“„kvalifikacija“, je treba poleg zgornjega pravila za razlago upoštevati tista potrdila, ki so opredeljena s pomočjo tega vnosa „Sie“„kvalifikacija“, ki je sestavljen po načelu niza „filtrov“, ki nadalje opredeljujejo sklop potrdil in zagotavljajo dodatne informacije o „podpori SSCD“ in/ali „pravni osebi kot subjektu“ (npr. tista potrdila, ki vsebujejo posebno OID v razširitvi politike potrdila, in/ali ki imajo poseben vzorec „uporabe ključa“, in/ali so filtrirana s pomočjo posebne vrednosti, ki se pojavi v določenem polju ali razširitvi itd.), in sicer v skladu z naslednjim nizom „kvalifikatorjev“, ki nadomeščajo pomanjkanje informacij v ustreznem QC, tj.:
‘QCNoSSCD’ qualifier value meaning ‘QC not supported by an SSCD’, or
vrednost kvalifikatorja „QCNoSSCD“ pomeni „QC, ki ni podprt s SSCD“, ali
‘QCSSCDStatusAsInCert’ qualifier value meaning that the SSCD support information is ensured to be contained in any QC under the ‘Sdi’ - ‘Sie’ provided information in this CA/QC entry;
vrednost kvalifikatorja „QCSSCDStatusAsInCert“ pomeni, da so informacije o podpori SSCD zagotovo vsebovane v vseh QC pod informacijami „Sdi“-„Sie“ v tem vnosu CA/QC,
AND/OR
in/ali
to indicate issuance to Legal Person:
navedba izdaje pravni osebi:
‘QCForLegalPerson’ qualifier value meaning ‘Certificate issued to a Legal Person’.
vrednost kvalifikatorja „QCForLegalPerson“ pomeni „potrdilo, izdano pravni osebi“.
Services supporting ‘CA/QC’ services but not part of the ‘CA/QC’‘Sdi’
Storitve, ki podpirajo storitve „CA/QC“, vendar niso del „CA/QC“„Sdi“
The cases where the CRLs and OCSP responses are signed by keys other than from a CA issuing QCs (‘CA/QC’) should also be covered.
Zajeti je treba tudi primere, ko so odzivi CRL in OCSP podpisani s ključi, ki niso ključi CA, ki izdajajo QC („CA/QC“).
This may be covered by listing those services as such in the TSL implementation of the TL (i.e. with a ‘Service type identifier’ further qualified by an ‘additionalServiceInformation’ extension reflecting an OCSP or a CRL service as being part of the provision of QCs, e.g. with a service type of ‘OCSP/QC’ or ‘CRL/QC’ respectively) since these services can be considered as part of the supervised/accredited ‘qualified’ services related to the provision of QC certification services.
To je mogoče zajeti s seznamom tistih storitev v izvajanju TSL zanesljivega seznama (tj. s „Service type identifier“, ki je nadalje opredeljen z razširitvijo „additionalServiceInformation“, ki odraža OCSP ali storitev CRL kot del zagotavljanja QC, npr. z vrsto storitve „OCSP/QC“ ali „CRL/QC“), saj je te storitve mogoče obravnavati kot del nadzorovanih/akreditiranih „kvalificiranih“ storitev, povezanih z zagotavljanjem storitev overjanja QC.
Of course, OCSP responders or CRL Issuers whose certificates are signed by CAs under the hierarchy of a listed CA/QC service are to be considered as ‘valid’ and in accordance with the status value of the listed CA/QC service.
Seveda je treba strežnike OCSP ali izdajatelje CRL, katerih potrdila podpišejo CA po hierarhiji navedene storitve CA/QC, obravnavati kot „veljavne“ in skladne z vrednostjo statusa navedene storitve CA/QC.
A similar provision can apply to certification services issuing non-qualified certificates (of a ‘CA/PKC’ service type) using the default ETSI TS 102 231 OCSP and CRL service types.
Podobno velja za storitve overjanja, ki izdajajo nekvalificirana potrdila (vrsta storitve „CA/PKC“) s pomočjo privzetih vrst storitev ETSI TS 102 231 OCSP in CRL.
Note that the TSL implementation of the TL MUST include revocation services when related information is not present in the AIA field of end certificates, or when not signed by a CA that is one of the listed CAs.
Izvajanje TSL zanesljivega seznama MORA vsebovati storitve preklica, če povezane informacije niso prisotne v polju AIA končnega potrdila ali če ni podpisa CA, ki je eden od navedenih CA.
Moving towards interoperable QC profile
Korak proti interoperabilnemu profilu QC
As a general rule, it must be tried to simplify (reduce) as far as possible the number of entries of services (different ‘Sdi’’s).
Na splošno si je treba prizadevati za kar največjo poenostavitev (zmanjšanje) števila vnosov storitev (različne „Sdi“).