EUDI Trusted Entity Checker
Paste a certificate and see whether the EU Digital Identity Wallet ecosystem trusts it, as a PID provider, a relying-party access certificate provider, or a public EAA provider.
Free and informational, and not a qualified validation service under eIDAS. Each mode below states what happens to your input.
The certificate is sent to the Tessio verifier service, checked in memory, and not stored.
What this checks
- Whether the certificate is listed on an EUDI List of Trusted Entities, and on which one.
- Otherwise, whether it chains to a listed entity using the certificates you paste.
- The entity and service behind the match, for example PID issuance or WRPAC issuance.
- Whether each list's own JWS signature verifies, and who signed it.
- Sourced from the EUDI trusted-list endpoints under ETSI TS 119 602, refreshed daily.
Frequently asked
What is a List of Trusted Entities?
The EU Digital Identity Wallet ecosystem publishes its own trust registry under ETSI TS 119 602, separate from the eIDAS trusted lists. It names the entities a wallet will accept: PID providers who issue the person identification data, WRPAC providers who issue the access certificates relying parties need, and public EAA providers. The lists are published as signed JWTs.
What does this checker tell me?
Paste a certificate and it reports one of three things: the certificate is itself listed as a trusted EUDI entity; or it chains to one; or it is on no list at all. It also names which list, which entity, and which service, for example PID issuance or WRPAC issuance.
Why would a certificate not be listed?
Because the wallet is meant to refuse it. A wallet checks the relying party before releasing any data, so a self-signed development certificate returns "not found" here and is rejected by a real wallet with an untrusted-chain error. That is the system working, not a fault.
How is this different from the EU Trusted List Checker?
Different registry, different regulation. The EU Trusted List Checker covers eIDAS qualified trust services under TS 119 612, used for qualified signatures and seals. This covers the wallet ecosystem under TS 119 602: who may issue a PID, and who may issue the access certificate a relying party presents to a wallet.
Are the lists themselves verified?
Yes. Each list is a signed JWS and its signature is checked against the certificate the list carries, so tampering after signing is detected. The result shows the signer and whether verification succeeded, per list. It does not yet establish that the signer is authorised by the scheme operator, which needs a published root for that scheme.