Why your digital certificate does not work in your browser

Key rules

• Browser: Use an up-to-date Chrome, Firefox or Edge on a desktop computer.
• Autofirma: You need Autofirma to sign with a certificate, but not just to log in with Cl@ve.
• Backup: Keep a .pfx backup of your certificate, made with an exportable key.
• Last resort: Revoke and replace the certificate only after every other fix has failed.

Browser support and the current Autofirma version change over time, so check both on the official Autofirma page before installing.

Start with the browser and system

Most failures are fixable. The usual causes are an unsupported browser, a certificate in the wrong place, or a missing or outdated Autofirma. Work through the checklist below in order and stop when it works.

Use a desktop computer with Chrome, Firefox or Edge, kept up to date. Requesting and downloading an FNMT certificate works on Windows, macOS and Linux. Safari has given problems, so switch browser if you use it. Requests now work from the browser, so you should not need older request tools.

Check where the certificate is installed

The browser can only offer a certificate it can find.

• Windows (Chrome, Edge): press the Windows key, type certmgr.msc and open it. Your certificate should be under Personal.
• Firefox: it keeps its own store. Look in Settings, then Privacy, then Certificates. A certificate installed for Chrome will not appear here until you import it.

If it is missing, import it again from your .pfx backup file. Tick the option that marks the key as exportable. Without it, you cannot make another backup later.

Clear out old browser data

Close every other browser window. Restart the browser, then clear the cache, cookies and old SSL state. A stale session often makes the site ignore your certificate.

Also check two basic things. The certificate must not have expired, and your computer's date and time must be correct. A wrong clock makes a valid certificate look invalid.

Autofirma

Autofirma is the government's free desktop program for signing with a certificate. You need it when a web form or procedure asks you to sign, for example when filing at an electronic registry. You do not need it just to log in with Cl@ve.

If signing fails, reinstall it. Download it only from the government's electronic administration portal, the official Autofirma page. Install the latest version for Windows, macOS or Linux. A mobile version exists for Android and iOS, but use a computer for the most reliable result.

Also reinstall the FNMT root certificates. Without them, your browser may not trust the certificate chain.

If it still fails

Try another browser or another computer. Then disable any extension or antivirus that could block the certificate, and test again.

Revoke the certificate and request a new one only when nothing else works. The warnings below explain why not to do it early. Steps differ a little between operating systems and browsers, so follow the menus you see on your own system.

Checklist

• Check the certificate is in the right store: in Windows, open certmgr.msc and look under Personal; in Firefox, look under Settings > Privacy > Certificates.

• Restart the browser and use a supported, up-to-date one: Chrome, Firefox or Edge.

• Reimport the certificate from your .pfx backup, ticking the option to mark the key as exportable.

• Reinstall Autofirma from the official government page, and reinstall the FNMT root certificates.

• Try another browser or computer, and disable any extension or antivirus that blocks the certificate.

What to watch out for

• Reimporting without an exportable key: If you reimport your .pfx backup without marking the key as exportable, you may not be able to back it up or move it again later. Tick the option to mark the key as exportable during import, and keep the .pfx file safe.

• Revoking too early: Revoking the certificate cannot be undone, and you will need to request a new one. Revoke only after the other fixes have failed: store, browser, date and time, reimport, reinstalling Autofirma, another browser or computer.

• Antivirus or extensions blocking the certificate: A browser extension or antivirus can stop the certificate from showing up, even when it is installed correctly. Disable them temporarily and try again, or test in another browser.

Frequently asked questions

Do I need Autofirma just to log in with Cl@ve?

No. Autofirma is only needed when a web form or procedure asks you to sign with a certificate, such as filing at the Registro Electrónico or the Sede Electrónica. Plain login with Cl@ve does not use it.

Where do I download Autofirma safely?

Download it from the Autofirma page of the government's Portal de Administración Electrónica, on the official website. Install the latest version offered there.

References

1. administracionelectronica.gob.es