See Full Document Text
Official Journal EN
of the European Union L series
2024/2683 15.10.2024
DECISION (EU) 2024/2683 OF THE EUROPEAN CENTRAL BANK
of 8 October 2024
amending Decision ECB/2013/1 laying down the framework for a public key infrastructure for the European
System of Central Banks (ECB/2024/26)
THE GOVERNING COUNCIL OF THE EUROPEAN CENTRAL BANK,
Having regard to the Treaty on the Functioning of the European Union, and in particular Article 127 and Article 132(1)
thereof,
Having regard to the Statute of the European System of Central Banks and of the European Central Bank, and in particular
Article 12.1 in conjunction with Articles 3.1 and 12.3, and Article 34 thereof,
Whereas:
(1) Decision ECB/2013/1 of the European Central Bank(1) established the framework for the Eurosystem public key
infrastructure (hereinafter the ‘ESCB-PKI’) to regulate the issuance and management of electronic certificates that are
required to access and use ESCB and Eurosystem electronic applications, systems, platforms and services with
medium or above medium criticality.
(2) The technology used by the ESCB-PKI has reached the end of its life and has been replaced. It is therefore necessary to
introduce a new online ESCB-PKI certification authority (hereinafter the ‘online ESCB-PKI certification authority
V1.2’), which should also take into account that the three-year validity of the certificates issued for ESCB and non-
ESCB users and technical components under an online ESCB-PKI certification authority cannot expire later than the
expiration of the certificate of that online ESCB-PKI certification authority itself. The certificate of the existing online
ESCB-PKI certification authority expires on 22 July 2026, and thereafter the online ESCB-PKI certification authority
V1.2 would be the sole online ESCB-PKI certification authority, until the expiry of its certificate.
(3) Therefore, Decision ECB/2013/1 should be amended accordingly,
HAS ADOPTED THIS DECISION:
Article 1
Amendment
The Annex to Decision ECB/2013/1 is replaced by the Annex to this Decision.
Article 2
Entry into force
This Decision shall enter into force on the fifth day following that of its publication in the Official Journal of the European
Union.
Done at Frankfurt am Main, 8 October 2024.
The President of the ECB
Christine LAGARDE
(1) Decision ECB/2013/1 of the European Central Bank of 11 January 2013 laying down the framework for a public key infrastructure for
the European System of Central Banks (OJ L 74, 16.3.2013, p. 30).
ELI: http://data.europa.eu/eli/dec/2024/2683/oj 1/3EN
OJ L, 15.10.2024
ANNEX
‘ANNEX
Information concerning the ESCB-PKI certification authority, including its identity, and its technical
components
The ESCB-PKI certification authority is identified in its certificate as the issuer and its private key is used to sign certificates.
The ESCB-PKI certification authority is in charge of:
(i) issuing private and public key certificates;
(ii) issuing revocation lists;
(iii) generating key pairs associated with specific certificates, e.g. those that require key recovery;
(iv) maintaining overall responsibility for the ESCB-PKI and ensuring that all the requirements necessary to operate it are
met.
The ESCB-PKI certification authority includes all individuals, policies, procedures and computer systems entrusted with
issuing electronic certificates and assigning them to the certificate subscribers.
The ESCB-PKI certification authority includes three technical components:
1. The Root ESCB-PKI certification authority: This certification authority, at the first level, only issues certificates
for itself and its subordinate certification authorities. It is only in operation when carrying out its own narrowly-
defined responsibilities. Its most significant data are:
Distinguished name CN = ESCB-PKI ROOT CA, O = EUROPEAN SYSTEM OF CENTRAL BANKS, C = EU
Serial number 4431 9C5F 91E8 162F 4E00 73F6 6AB8 71D8
Distinguished name of CN = ESCB-PKI ROOT CA, O = EUROPEAN SYSTEM OF CENTRAL BANKS, C = EU
issuer
Validity period From 21-06-201112:35:34 to 21-06-204112:35:34
Message digest (SHA-1) 3663 2FBA FB19 BDBC A202 3994 1926 ED48 4D72 DD4B
7963 2A97 1D12 A889 9724 BB35 C37B 51D2 3E21 4DF9 20C3 2450 093E
Message digest (SHA-256)
0EA7 49FB AAEB
Cryptographic algorithms SHA-256/RSA 4096
2. The Online ESCB-PKI certification authority: This certification authority, at the second level, is subordinate to
the Root ESCB-PKI certification authority. It is responsible for issuing ESCB-PKI certificates for users. It expires on
22 July 2026. Its most significant data are:
Distinguished name CN = ESCB-PKI ONLINE CA, O = EUROPEAN SYSTEM OF CENTRAL BANKS, C = EU
Serial number 660C 9B12 9A0A 6C21 5509 38DD 54A0 ED2D
Distinguished name of CN = ESCB-PKI ROOT CA, O = EUROPEAN SYSTEM OF CENTRAL BANKS, C = EU
issuer
Validity period From 22-07-201112:46:35 to 22-07-202612:46:35
Message digest (SHA-1) E976 D216 4A5F 62DA C058 6BE0 EC10 EF24 36B8 12AC
1335 26DC 99E9 CC36 62F8 F5FA 2006 3005 BA90 E663 2BF3 4F18 A84B A39B
Message Digest (SHA-256)
5FAA 5700
Cryptographic algorithms SHA-256/RSA 4096
2/3 ELI: http://data.europa.eu/eli/dec/2024/2683/ojEN
OJ L, 15.10.2024
3. The Online ESCB-PKI certification authority V1.2: This certification authority, at the second level, is subordinate
to the Root ESCB-PKI certification authority. It is responsible for issuing ESCB-PKI certificates for users. After 22 July
2026it is the sole online ESCB-PKI certification authority, until its expiry. Its most significant data are:
CN = ESCB-PKI ONLINE CA V1.2, O = EUROPEAN SYSTEM OF CENTRAL BANKS, C
Distinguished name
= EU
Serial number 1121 4958 04E1 E706 695D D1D1 2997 FAEF 6653
Distinguished name of CN = ESCB-PKI ROOT CA, O = EUROPEAN SYSTEM OF CENTRAL BANKS, C = EU
issuer
Validity period From 08-06-202317:07:00 to 08-06-203817:07:00
Message digest (SHA-1) DC92 042E 6316 CB60 F8F6 109B 8C43 F3C6 AF2F B2F3
96B7 8E9C F914 ED4D 072D 93C8 C531 DEEF D102 7571 7218 A202 0924
Message Digest (SHA-256)
3216 99D8 1C48
Cryptographic algorithms SHA-256/RSA 4096’
ELI: http://data.europa.eu/eli/dec/2024/2683/oj 3/3