Firefox 153 QWAC Certificate Verification: A New Line in Your Padlock Icon - QAInsights
Skip to content
Share via:
Copy Link
More
In this blog post, we will see what changed in Firefox 153 around certificate verification, why a small padlock detail now matters a lot more than before, and what a Qualified Website Authentication Certificate (QWAC) actually tells you about a site.
I spend a good chunk of my day at Salesforce/MuleSoft dealing with PKI and authentication, so when I saw this show up in a browser panel, I had to dig in. This is not a flashy feature. It is a quiet one. But if you work anywhere near certificates, TLS, or backend authentication, it is worth understanding.
Table of Contents
Toggle
What is a QWAC
QWAC stands for Qualified Website Authentication Certificate. It is a certificate type defined under the EU’s eIDAS Regulation (originally Regulation 910/2014, now updated by eIDAS2, Regulation (EU) 2024/1183).
Unlike a regular TLS certificate issued by any certificate authority in your OS or browser trust store, a QWAC can only be issued by a Qualified Trust Service Provider (QTSP). A QTSP goes through a formal audit process and has to verify the legal identity of whoever is requesting the certificate with a much higher bar than a standard Domain Validated (DV) certificate.
Think of it as the legal identity layer sitting on top of the usual cryptographic identity layer that TLS already gives you.
What changed in Firefox 153
Firefox has supported the idea of QWACs behind a pref for a while, but Firefox 153 is the release where Mozilla flipped it on by default on desktop. The relevant bug (2043399, filed by Dana Keeler on the PSM team) is titled plainly: "enable QWACs by default on desktop."
Here is what that actually means under the hood:
Firefox now discovers QWACs presented alongside the regular TLS certificate during the handshake.
It verifies the QWAC against the EU Trusted List infrastructure.
It performs revocation checking on that QWAC, same as it would for a normal cert chain.
If everything checks out, it surfaces the qualified identity in the connection info panel, the little padlock dropdown you get when you click the site info icon.
The official release note wording from Mozilla is straightforward: "Firefox now verifies and displays Qualified Website Authentication Certificates (QWACs) in accordance with eIDAS regulations."
Walking through a real example
The screenshot that got me writing this is a QWAC in the wild, on eidas.ec.europa.eu, the EU’s own eIDAS dashboard site. Head to eidas.ec.europa.eu/efda/home in Firefox 153 and click the padlock icon, then "Connection protections," and you will see something like this:
Certificate issued to : The European Commission, Brussels, BE
Verified by : Greek Universities Network (GUnet)
Qualified as specified in : Regulation (EU) 2024/1183
As shown in the below screenshot, this is exactly the layout Firefox now renders. GUnet here is acting as the QTSP. It did the identity vetting for "The European Commission" as a legal entity and issued the QWAC. Firefox verified that chain against the EU Trust List and is now telling you, in plain language, who legally stands behind this site.
Compare that to a typical DV certificate from Let’s Encrypt on some random domain. That certificate proves you are talking to whoever controls the private key for that domain name. It says nothing about who that legal entity actually is. The QWAC panel is the difference between "this is definitely example.com" and "this is definitely example.com, and example.com is legally the European Commission, verified by an accredited body."
Before it was built in: the eIDAS QWAC Validator extension
Here is the part I found genuinely interesting while digging into this. QWAC detection in Firefox is not a new idea. It has existed as a third-party extension for years, called eIDAS QWAC Validator, built by AgID, the Agenzia per l’Italia Digitale (Italy’s digital agency).
The add-on shows a greyed-out EU flag icon at the right of the address bar. Visit a site with a valid QWAC and the flag lights up in EU colours. Visit a site without one, or with a broken one, and it stays grey or shows a red exclamation mark. Under the hood it queries the European Commission’s TL-Browser API to check the certificate against the EU Trusted Lists, and it looks for qcStatement metadata conforming to ETSI EN 319 412-5 to decide whether a certificate qualifies at all.
That is a genuinely clever piece of engineering for 2019, when it was first published. But looking at it now, next to what shipped natively in Firefox 153, it is a good case study in why "built in" beats "bolted on":
Adoption never happened. The listing shows 9 users and a 3 out of 5 rating from 2 reviews. Years of availability, barely any pickup. A feature buried behind an optional extension install is a feature almost nobody finds.
The permission ask was heavy for...