Skip to main content
Hafan

Using the UK Trusted List

Contents

At a glance

  • You can use the UK trusted list to check the details and status of qualified trust service providers and their services.
  • You can download the trusted list, authenticate it to check it is legitimate and monitor it to determine when its content changes.

In brief

What is the UK trusted list?

The UK trusted list shows whether a trust service provider has been granted qualified status and which of its services are qualified. The trusted list is the single authoritative source you can use to verify that the ICO has granted a trust service provider and one or more of its services qualified status. The trusted list also contains historical information on previously qualified trust service providers that may or may not now exist.

The trusted list is published in a machine readable (XML) format, and although the list is primarily for automated processing, it has a well-defined structure and contains qualified trust service provider and qualified trust service data that can be viewed, searched and navigated in web browsers. If the list is opened directly in a browser, you will see the list XML structure and contents. You may be presented with a message saying the XML file has no associated style information.

Qualified trust service providers and their qualified trust services are also listed here.

How can I check the details and status of a qualified trust service?

The trusted list contains an entry for each qualified trust service provider. This entry contains details such as:

  • the qualified trust service provider name and address.
  • when qualified status was granted.
  • the types of services that have been approved as qualified.
  • what the services can be used for.
  • associated historical information (where applicable) on the provided services..

When you are verifying a trust service output e.g. a qualified electronic signature, you may need to check the UK trusted list as part of your verification procedures.

Where can I get the trusted list?

The ICO hosts the trusted list. To support publication of the trusted list there is also a SHA256 digest file of the list to allow monitoring of changes to the list, and a list verification digital certificate to verify the digital signature on the list.

How can I check the authenticity of the trusted list?

You can check the authenticity of the trusted list by verifying the digital signature on the list using the ICO verification certificate. You can download the certificate in either binary (DER) or text (Base64 encoded) format. The certificate thumbprint is a3 ad 36 4f 7f af d5 7b f7 0c e0 3d e0 f4 89 33 d7 12 07 a2.

The verification certificate may be changed up to 1 year prior to expiry and you can check these pages before that time for notification of any change.

How can I check when the trusted list changes?

You can monitor for changes to the trusted list content e.g. the addition of a newly qualified trust service provider or a change in the status of an existing one by checking the SHA256 digest value of the currently published trusted list against a locally cached version.

Why has the trusted list moved to the ICO?

DSIT (Department for Science, Innovation and Technology), the UK Government department responsible for eIDAS, transferred the responsibility for management and publication of the trusted list from tScheme to the ICO. The ICO has been the UK trusted list scheme operator since 1 October 2022.

Will tScheme continue to also publish the trusted list?

From 1 October 2022, the trusted list will no longer be available from the tScheme website and will only be available from the ICO website.

What is the ‘final EU UK’ trusted list’?

At the end of the Brexit transition period tScheme published a final version of the EU UK trusted list. This will continue to be available on the tScheme website.

Will the ICO publish a PDF version of the list?

The ICO does not publish a PDF version of the list. The machine readable (XML) version of the list has a well-defined structure and contains qualified trust service provider and qualified trust service data that can be presented, searched and navigated in web browsers.

How can I get more information of the trusted list move?

If you need additional information on the trusted list, please contact the ICO at [email protected].