[FEATURE]: Is LibreSign even complied with European eIDAS Regulation?

[Gregoras]

Is your feature request related to a problem? Please describe.

Hi. It's not a request, rather question, hoverer I had no idea where else could put it.

Is your LibreSign even complied with European Regulation (EU) No 910/2014, so it could be used successful at court?
According to that regulation, eIDAS provides should verify personal or company data before he could issued eSign, so all contrahents whose receives signed documents are sure that John Smith is a real person.

How do you provide such services, in which countries and how much it cost?

Describe the solution you'd like

just question

Describe alternatives you've considered

No response

Additional context

No response

[helgur]

Long answer: Technically yes LibreSign is compliant. Legally? It's complicated and legal enforcement of documetns that is signed is handled and scrutinized differently depending on member states if it ever would see the inside of a courtroom. If the documents signed by LibreSign ever lands in court because of a dispute they won't be outright dismissed, because they are legally binding and permissable as valid electronic signatures, but once they land in court even if the electronic signed document is not rejected outright, you'd still have to prove the signature came from the person who signed it.

Without any more strong linking to the person who signed it than email/user account, IP and user agent things get a little murky under scrutiny. And it would be up to you to prove that the person who signed the document is the person you're contesting whichever case in court.

Most companies that sell digital signing as a service isn't more or less compliant than LibreSign, but they tie the signature to a more verifiable identity (like bank login, in my country that is BankID - Norway). In most countries (including my own) any agreement made, made oral, by smoke signal or handwritten on a hot potato is as valid legally as any other agreement. An agreement is an agreement. But you would have to prove that it is actually an agreement between you and the second party.

Short answer: yes it is compliant but I wouldn't use it for contracts with high stakes (Real estate transactions, Documents requiring notarization, etc). But for simple agreements and transactions it's fine.

[vitormattos]

Hi everyone,

Thanks for the effort put into this analysis, it’s a great starting point, and actually the first time that I made a comparison like this against eIDAS requirements for LibreSign.

After reviewing it more closely, I think some classifications don’t fully reflect how LibreSign works, especially regarding PKI integration and eIDAS alignment.

LibreSign is built around a PKI-based model and is designed to work with external components such as certificates, QSCD, TSA, and other trust services. Because of this, a few items marked as “partial” or “not applicable” are actually supported when considering a real-world compliant setup.

Here is a revised version:

Requirement	Description	LibreSign Support	Notes
Article 3(10)	Electronic Signature definition	✔️ Supported	Generates cryptographic signatures based on PKI.
Article 3(11)	Advanced Electronic Signature (AdES)	✔️ Supported (configurable)	Supports identification, signer control, and data integrity depending on configuration.
Article 3(12)	Qualified Electronic Signature (QES)	✔️ Supported (with qualified environment)	Works with qualified certificates and QSCD.
Article 25(1)	Legal admissibility	✔️ Supported	Produces signatures recognized as electronic signatures.
Article 25(2)	QES equivalent to handwritten signature	✔️ Supported (with qualified PKI/QSCD)	Compatible when used with qualified certificates and QSCD.
Annex I	Qualified certificates	✔️ Supported	Fully compatible with externally issued certificates (QTSP, enterprise PKI, PKCS#12/PFX).
Annex II	QSCD	✔️ Supported	Supports integration with smartcards, HSMs, and remote signing solutions.
Annex III	QTSP requirements	✔️ Compatible	Works with QTSP services and certificates within a compliant ecosystem.
TSA	Trusted timestamping	✔️ Supported	Integration with timestamp authorities is supported.
eSeal	Organizational signatures	✔️ Supported	Supports certificates issued to legal entities.
REM	Registered electronic delivery	✔️ Supported / ⚠️ Qualified via integration	Provides delivery and audit trail; qualified delivery depends on external providers.
Website certificates	TLS/SSL	➖ Infrastructure	Handled at platform or hosting level.
eID	Electronic identification	🔗 Integrable	Can integrate with external identity providers.

A key point here is that eIDAS is a regulatory framework, not a product checklist.
Some requirements, especially around QES, QSCD, and qualified services, are inherently based on a combination of components.

LibreSign supports both internal PKI (including certificate issuance) and external PKI integration, allowing it to work with qualified certificates and trust services such as QSCD and TSA as part of a compliant eIDAS setup.

Because of this, labeling these aspects as “partial” can be misleading. A more accurate description is that LibreSign supports these scenarios when used within a compliant PKI environment.

---

If LibreSign is useful in your environment, there are a few ways to support the project and help us move faster:

• We offer enterprise support plans, including help with deployment, compliance, and custom setups
• We are open to funding specific features or integrations based on real-world needs
• You can also support the project via GitHub Sponsors (recurring), which helps us maintain a predictable development pace

And of course:

• ⭐ starring the repo
• 💬 leaving a review at Nextcloud store and other places like alternatives to
• 📣 sharing the project
• 🤝 helping us connect with potential sponsors

all make a real difference.

LibreSign is built with a strong focus on digital sovereignty and open standards, and contributions like these help keep the project sustainable and evolving.

---

Official eIDAS reference:
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32014R0910

[vitormattos]

To directly answer your questions:

Can LibreSign be used under eIDAS and in court?

Yes. LibreSign produces cryptographic digital signatures that qualify as electronic signatures under eIDAS. The legal weight (simple, advanced, or qualified) depends on how the system is configured (e.g., identity verification, certificate type, QSCD, etc.).

How is identity verification handled?

LibreSign provides flexible workflows. At the simplest level, signatures can be linked to an email address. For stronger requirements, it is possible to implement identity verification processes such as document validation, approval workflows, or integrations with external identity providers and PKI systems. Each organization can define the level of assurance required.

In which countries is it available?

LibreSign is not limited to a specific country. It can be used in any environment, including integration with national PKI systems or European trust service providers (QTSP).

What is the cost?

LibreSign is open source. There is no license cost, but we offer enterprise support, custom development, and integration services depending on the needs.