[hannob]

A key idea behind all of this is to sell "qualified certificates". Which is another way of saying "expensive certificates".

In the past, CAs sold EV certificates which gave you a nice green look in the browser bar and no security advantage (arguably security downsides, because you cannot automate it). That was good business, until browsers decided that this makes no sense and scraped any special treatment for EV certificates.

The "qualified certificates" by the EU are essentially EV with a new name.

[johnfonesca]

>Which is another way of saying "expensive certificates".

True, basically eIDAS is a cartel. With the help of EU legislation, some Certification Authorities banded together and are now saying that certificates emited by anyone but them are not good. And obviously they fully controll the pricing for the "good" certificates.

[sofixa]

> True, basically eIDAS is a cartel. With the help of EU legislation, some Certification Authorities banded together and are now saying that certificates emited by anyone but them are not good

For very specific needs like electronic signatures, "seals" and an interesting one I hadn't heard before, timestamping (proving that an electronic document has existed at that timestamp), not for general computing.

Also, considering Bulgaria has 5 CAs on the official list, with 2 others as potential, the claims of a shady cartel of "big Cert" being behind this is laughable.

[mananaysiempre]

Scott Helme had a similar take back in 2022[1].

[1] https://scotthelme.co.uk/looks-like-a-duck-swims-like-a-duck...