The role of trust service providers.
What a trust service provider does and why its supervision underpins everything else.
Behind every certificate based signature stands someone who does not appear in the document but holds it up: the trust service provider. It issued the signer's certificate, verified the signer's identity, keeps current information on whether that certificate is still valid and, often, also provides the timestamp or holds the key in custody. If the provider fails, every signature that depends on it is called into question. That is why it is the most heavily regulated piece of the system.
What a provider does
- Verifies identities. Directly or through registration authorities, it confirms who each person is before issuing them a certificate.
- Issues certificates. It binds a public key to a person or organization, signing as the authority.
- Reports validity. It publishes revocation lists and answers online queries about the status of each certificate.
- Provides other services. Timestamps, remote signing with key custody, signature validation, preservation of signed documents.
Why it is trusted
A provider does not become trustworthy by saying so. Trust is built from verifiable pieces.
- Written rules. Each provider publishes its certificate policy and certification practice statement, which state what it does and how. RFC 3647 proposes a common structure for these documents.
- Independent audit. A third party periodically checks that actual practices match the written ones. In Europe this is done by conformity assessment bodies; other markets use schemes such as WebTrust.
- Supervision. A public body accredits the provider and can sanction it and withdraw its authorization.
- Publication. Trusted lists or official registries show who is authorized and since when.
Liability and continuity
The most mature frameworks also require two things that are often forgotten. The first is liability: if the provider acts negligently and causes harm, it is answerable, and it must have the resources or insurance to cover that. The second is continuity: a termination plan ensuring that, if it ceases operations, the information needed to validate the signatures it issued remains available. A signature cannot die because its provider closed down.
| Question for a provider | Where to find the answer |
|---|---|
| How does it verify identities? | Its certification practice statement. |
| Who audits it, and when? | Audit reports or certificates. |
| Is it authorized? | The trusted list or the official registry. |
| What happens if it shuts down? | Its termination plan. |
| What is the limit of its liability? | Its terms and insurance. |
The trust service provider verifies identities, issues certificates, reports on their validity and provides services such as timestamps and remote signing. Its trustworthiness rests on written rules, independent audits, public supervision and publication, plus liability and continuity plans.