2 ms·

> Now 7 years later there still isn't a API specification for interoperability The standard existed 2016, I did a short stint for a company that was implemente

> Now 7 years later there still isn't a API specification for interoperability The standard existed 2016, I did a short stint for a company that was implemented eIDAS back then. They even have a test suite you can use to check how well you comply with the standard: https://ec.europa.eu/digital-building-blocks/wikis/display/DIGITAL/ETSI+Signature+Conformance+Checker https://ec.europa.eu/digital-building-blocks/wikis/display/D... It is very archaic to work with though, but at least they try to have a standard.

johnfonesca 3y ago
The ETSI checker you have linked doesn't have anything to do with CA API interoperability and "switch document signer provider". That's just a basic tool which validates if a signature is PADES/ETSI compliant or not. The real value in eIDAS would be "unlocked" if they would release a proper API specification with which a digital signatures application would integrate with any EIDAS CA to emit/sign certificates. And then enforce that any eIDAS compliant CA would implement this API. In practice that means any company/digital signatures product could do a integration with this API once and then be able to use ANY certification authority they want/need/offer best prices for certificates. Without this API, eIDAS is just a marketing moniker because the power belongs to the selected Certification Authorities. They set the prices, they choose WHOM can integrate with them to isse certificates and there is NO interoperability between them. This doesnt allow for a open market and makes the top players control everything while shouting "standards" and "eIDAS".....