EU root CA / trust services

Why important?

PKI and trust services are central to identity, TLS and signatures.

How measured?

• 0 = Trust anchors / root CA non-EU (or unsuitable) without alternatives
• 1 = EU trust only claimed, details unclear
• 2 = EU trust for part of the scope (some services), key paths unclear
• 3 = EU root CA/trust services for the core scope, but not throughout
• 4 = EU trust services broadly documented (root CA, signing, possibly HSM) with few gaps
• 5 = EU trust anchors throughout (root CA/signing/key custody) + verifiably evidenced
• N/A = no reliable evidence

Sources / Evidence

• https://www.aboutamazon.eu/news/aws/built-operated-controlled-and-secured-in-europe-aws-unveils-new-sovereign-controls-and-governance-structure-for-the-aws-european-sovereign-cloud
• https://www.ovhcloud.com/pl/bare-metal/secnumcloud/
• https://aws.amazon.com/blogs/security/announcing-initial-services-available-in-the-aws-european-sovereign-cloud/
• https://aws.amazon.com/blogs/aws/announcing-aws-kms-external-key-store-xks/
• https://aws.amazon.com/blogs/aws/opening-the-aws-european-sovereign-cloud/
• https://www.deloscloud.de/about-us/news.html

Validation questions (RFP)

• Which certificate authorities issue the platform's TLS, signing and identity certificates, and in which jurisdiction are they based? Is there an EU root CA or are there qualified trust services under eIDAS? Can customers integrate their own PKI and root certificates?

Scores comparison