EU List of Trusted Lists — cache
What this is. The European Commission publishes a signed List of Trusted Lists (LOTL) that points at each EU Member State's national Trusted List (TSL). Each MS list in turn contains the X.509 certificates of the qualified trust service providers operating in that country — the entities allowed to issue qualified certificates, qualified electronic timestamps, qualified electronic seals and, from eIDAS 2 onwards, elements of the European Digital Identity Wallet. All lists conform to ETSI TS 119 612 (XML-based Trust-service Status List format).
What this page shows. A live snapshot of the trust anchors the CodeB verifier has fetched from that structure. When a wallet presents an x5c-based OpenID4VP request, our verifier chains the leaf certificate up to one of the anchors listed below. Refresh cadence: daily background timer + on-demand lazy refresh; last-refresh timestamp shown above. All figures come straight from the signed EU endpoints listed below — nothing on this page is tenant-specific and no sign-in is required.
Authoritative EU endpoints. Everything on this page derives from these four canonical sources published by the European Commission:
- Primary signed LOTL (XML, machine-readable).
https://ec.europa.eu/tools/lotl/eu-lotl.xml— signed directly by the European Commission using XMLDSig / XAdES per ETSI TS 119 612. Carries pointers to every EU/EEA Member State's national TSL along with the public-key certificates the national authorities sign their lists with. This is the file this deployment fetches, parses and caches. - Interactive human-readable browser (eIDAS Dashboard).
https://eidas.ec.europa.eu/efda/tl-browser/— official EU portal for humans to browse Trust Service Providers (TSPs) and their service digital identifiers per Member State. Useful for cross-checking any anchor listed below. - Per-country EU eIDAS lists (browser view).
https://eidas.ec.europa.eu/efda/trust-services/browse/eidas/tls— direct per-Member-State entry into the eIDAS trusted-lists browser. Each row corresponds to one national TSL that our verifier ingests from the LOTL, so the counts you see there for a given country should track our "Anchors" column below. - Third Countries Trusted Lists (TC AdES).
https://eidas.ec.europa.eu/efda/trust-services/browse/tc-tls— the EU Commission maintains two separate trusted lists here under Article 14 mutual-recognition agreements: currently Ukraine (UA) and Moldova (MD). Their qualified trust services are recognised as legally equivalent to EU-issued ones under specific bilateral agreements. Not yet ingested by this deployment's LOTL cache but tracked as a roadmap item; linked here for completeness so verifiers can cross-check UA/MD-issued qualified signatures manually until we wire them into the anchor set. - Age Verification Trusted List (DSA Article 28).
https://trust.tech.ec.europa.eu/lists/age-verification/av-tl.xml— DSA-mandated register of recognised age-assurance providers. Same TSL family (ETSI TS 119 612) but a different trust ecosystem; verifier work on this list is on the roadmap.
Signature verification. The signed LOTL is authenticated via XMLDSig / XAdES per ETSI TS 119 612. The European Commission publishes its signing certificates via the Official Journal and via the keystores in the eIDAS Technical Specifications; our verifier chains anchors reached through this cache to those Commission-published signing certificates. If a Member State rotates its TSL signer, the LOTL's OtherTSLPointer block flips and the next scheduled refresh picks the new certificate up.
API. This page reads /lotl.ashx?status. The public endpoints /lotl.ashx?anchors (with optional &country=XX filter) and /lotl.ashx?anchor=<sha256hex> (returns one cert as PEM) are documented on the API reference page. Only ?refresh requires an admin bearer token — status, anchor listing and PEM download are open to anonymous callers, in line with the underlying LOTL being a public register.
What we do not claim. Presence of a certificate in this cache means the European Commission's LOTL structure points at a national Trusted List that includes it. It does not constitute a self-claim that the CodeB verifier is a Qualified Trust Service Provider under eIDAS 2. We are not a QTSP and we do not issue qualified certificates.