How to get a digital certificate in Spain, step by step

How to get a digital certificate in Spain: the short answer

To get the FNMT digital certificate, you apply on its website or in its app, prove your identity (at an office, with your electronic ID card or by video) and download it. It is free, except for video identification, and with the office or DNIe route it is ready in about 1 hour.

What the digital certificate is and why you need it as a self-employed worker

A digital certificate is a file that identifies you online and lets you sign procedures with the Spanish authorities. A common choice for the self-employed is the certificate from the Fábrica Nacional de Moneda y Timbre (FNMT-RCM), the Spanish state mint. Its website now calls it the Citizen Certificate (Certificado de Ciudadano). It is the same certificate that used to be known as the persona física (individual) certificate.

There is no separate "self-employed digital certificate". As an autónomo, you use your personal certificate for everything you do in your own name:

• Registering with Hacienda using Form 036 (modelo 036) and with the Seguridad Social, the Spanish social security system (we cover it in our guide to registering as self-employed).
• Filing your quarterly taxes, such as Form 303, and your annual income tax return (the Renta).
• Reading notifications from the AEAT (Agencia Estatal de Administración Tributaria, Spain's tax agency, also called Hacienda) and answering a letter from Hacienda.

According to the AEAT's 2026 taxpayer calendar, you can file online with an electronic certificate, an electronic ID card (DNIe), Cl@ve or a reference number. The certificate and the DNIe work for every form. Only individuals can use Cl@ve, and the reference number only works for personal income tax (IRPF) procedures.

The four ways to get the FNMT certificate

They all start the same way: you set up your computer, apply online and get an application code by email. What changes is how you prove it is you.

Source: FNMT website, checked on 13 October 2026.

(opens the image in a new tab)

The app is not a fourth way to prove your identity: it is another channel, and inside it you pick one of those three. The last row matters more than it looks. If you get the certificate with a DNIe, with another certificate or by video, you will not be able to renew it online when it expires: you will have to prove your identity again. We cover this in the renewal section.

Step by step: getting the digital certificate with an office identity check

This is the route for you if you have an NIE and no other certificate yet, because video identification, for now, requires a DNI. Do everything from the same computer and the same user account: the FNMT explicitly asks for this.

1. Install the FNMT-RCM Configurator. This is the program that generates your keys. There are versions for Windows, macOS and Linux; on a Mac with an Apple chip you may need to install Rosetta, according to the FNMT's prior setup page. It works with the latest versions of Firefox, Chrome, Edge, Opera and Safari.
2. Apply online. You fill in your identity details and your email. When you finish, you get an application code by email.
3. Prove your identity at an office. You bring the code and your ID document: your DNI or, if you are a foreign national, the document showing your NIE together with your passport (or your national ID card, if you are an EU citizen), according to the FNMT's list of documents. There are offices at the AEAT, the Seguridad Social and many town halls (the FNMT has an office finder). AEAT and Seguridad Social offices require an appointment.
4. Download and install the certificate. About 1 hour after the identity check, go back to the FNMT website from the same computer, enter the code and download it.
5. Make a backup. Export the certificate to a password-protected file and keep it somewhere other than your computer.

Source: getting the certificate with an in-person identity check, FNMT.

(opens the image in a new tab)

How to get the digital certificate without leaving home

With your electronic ID card (DNIe)

If your DNIe's certificates are valid and not revoked (the card itself being in date is not enough), you know its PIN and you have a card reader, you can apply for the certificate with your DNIe without going to any office. An Android phone with NFC also works as a reader; in that case the FNMT says to use Firefox. You install the Configurator, apply by identifying yourself with your DNIe, receive the code and download the certificate about 1 hour later.

With video identification

This is the option if you have a DNI but no reader or PIN. You apply, scan the QR code shown on screen with your phone and record the video with your DNI. The FNMT reviews the video in about 48 working hours and lets you know by email. If it is approved, you download the certificate with your code. The video identification service costs €2.99 plus tax; the certificate itself is still free.

From the Certificado Digital FNMT app

The official app, available on Google Play and the App Store, lets you do the whole process on your phone. You apply in the app and prove your identity by video identification, at an office or by reading your DNIe. Two things to keep in mind:

• You can only hold one FNMT Citizen Certificate. If you apply for a new one from the app, the previous one is revoked automatically.
• The certificate is a file, not tied to your phone: with the backup you can also install it on your computer.

How long the certificate lasts and what changes until 2028

By law, a qualified certificate cannot last more than five years (article 4 of Law 6/2020).

On 9 December 2025 the FNMT published its "Plan de transición a Certificados de Curva Elíptica (ECC)" (transition plan to elliptic curve certificates) on its news page, following guidelines from Spain's National Cryptologic Centre. The dates that affect you as a user, also set out in its certification policy for citizens (section 6.3.2):

That certification policy (version 2.0, approved on 11 November 2025, section 6.3.2) sets two limits: RSA Citizen Certificates from the AC FNMT Usuarios are valid until 31 December 2028, and ECC ones from the G2 hierarchy for 4 years at most. In practice, if you are issued an RSA certificate in October 2026, it cannot be valid beyond 31 December 2028; if it is ECC, it cannot last more than 4 years. Always check the exact date in the certificate's details, inside your browser.

How to renew your digital certificate

Renewal is done online during the 60 days before the expiry date, as long as the certificate has not been revoked. The steps:

1. Install or update the FNMT-RCM Configurator.
2. Go to "Solicitar renovación" (request renewal) from the browser where your current certificate is installed. You identify yourself with it and choose a new password, which cannot be recovered.
3. You get an application code by email.
4. About 1 hour later, you download the renewed certificate and make another backup.

In some cases you cannot renew it this way and have to prove your identity again (at an office, by video or with your DNIe):

• It has already expired. An expired certificate cannot be renewed.
• You got it by identifying yourself with another certificate, with your DNIe or by video identification.
• You have already renewed it once.

(opens the image in a new tab)

Example: Lucía registers as self-employed and gets her certificate before 20 October

Lucía is a graphic designer who registered as self-employed in July 2026 and has been getting by with Cl@ve. She wants to sign a contract with a public-sector client that asks for a certificate and, while she is at it, have it ready for her first Form 303, for the third quarter (it is her first because July to September is her first quarter with activity; the second-quarter return, April to June, did not apply to her). Its deadline runs from 1 to 20 October 2026 (until the 15th if you pay by direct debit), according to the taxpayer calendar.

1. 13 October 2026. She installs the Configurator on her laptop, applies and receives the code. She books an appointment at her nearest Seguridad Social office.
2. 15 October 2026. She proves her identity at the office. About 1 hour later, she downloads the certificate on the same laptop and saves a backup to a USB stick.
3. 16 October 2026. She files Form 303 on the AEAT website with her new certificate, within the deadline that ends on 20 October.
4. Expiry. Checking the details, she sees she has been issued an RSA certificate that expires on 31 December 2028.
5. 1 November 2028. Her renewal window opens: 60 days before expiry. Because she got it at an office and has never renewed it, she will be able to renew it online.

Total cost for Lucía: €0, because she chose the office identity check. Had she used video identification, she would have paid €2.99 plus tax and had to wait for the video review, about 48 working hours, with the Form 303 deadline looming.

(opens the image in a new tab)

Digital certificate or Cl@ve: which one suits you

Cl@ve is the Spanish government's username and password identification system. It comes in three forms: Cl@ve Móvil (you confirm access in the Cl@ve app), Cl@ve PIN (a one-time code you must use within 10 minutes) and Cl@ve Permanente (a fixed password). You register by video identification in the Cl@ve app (for now, only with a valid Spanish DNI), with an invitation letter sent to your tax address, with a certificate or DNIe, or at an office.

Form 036 cannot be filed online, with either a certificate or Cl@ve, in two cases, according to the AEAT's Form 036 guide:

• Applying for a tax ID (NIF), because filing the form online requires already having an NIF.
• When the members of a pass-through entity (entidad en atribución de rentas) waive the objective assessment (módulos) or simplified direct assessment for IRPF, or the simplified scheme or the special agriculture, livestock and fishing scheme for VAT. It needs every member's signature, so it is filed on paper.

To apply for an entity's NIF, the AEAT also has a remote procedure: you validate Form 036 as a PDF, the entity's representative signs it and the person filing uploads it with their own certificate to the electronic register, together with the scanned documents.

And Form 036 requires a certificate, even if you are an individual, when you use it to:

• Apply to join the monthly refund register.
• Opt in or out of keeping your VAT record books on the AEAT website (SII).
• Report starting or stopping the obligation to have invoices issued by your customers or by third parties (the self-billing case).

Sources: the AEAT's 2026 taxpayer calendar and VAT practical manual 2026.

For a self-employed worker with quarterly VAT, Cl@ve covers almost everything. The certificate is worth it if you sign documents often, if you work with public bodies that ask for it or if you want a route that does not depend on your phone. The practical answer is to have both.

If a gestor files for you: the power of attorney

You do not need to hand your certificate to anyone. The AEAT lets you grant a power of attorney (apoderamiento) so that someone else can file procedures on your behalf with their own electronic certificate. You can grant it online with your electronic signature, in person at an AEAT office or through a notarised document.

Sharing your certificate file and its password with someone else is a bad idea: it can be used to sign anything in your name, not just your taxes.

Common mistakes when getting a digital certificate

• Switching computers or user accounts between applying and downloading. The keys are generated on the computer and user account you applied from. If you switch, the download fails.
• Paying a private website for something free. The FNMT certificate is free; only video identification costs €2.99 plus tax.
• Not making a backup. If your computer breaks and you have no copy, you have to start again.
• Letting it expire. An expired certificate cannot be renewed and, if you got it with a DNIe or by video, you could not have renewed it online anyway.
• Assuming it lasts for years and years. RSA Citizen Certificates expire on 31 December 2028 at the latest, and ECC ones last 4 years at most.
• Confusing the citizen certificate with the representative certificate. To act on behalf of a company yourself you may need a representative certificate, which has its own application process; an authorised agent or registered collaborator can also file for the company with their own certificate.

How Melso helps

Melso is your AI tax agent, with human professionals behind it. You send it receipts and invoices on WhatsApp, Melso organises your income and expenses, spots what is missing and keeps you on top of the tax calendar; its professionals prepare and review the returns included for your activity and tax profile, you approve the exact draft in the app and, with the necessary authorisation, the professional files the approved version with the AEAT. If you have not registered yet, Melso collects what the registration needs and a Melso gestor files your self-employed registration with Hacienda and the Seguridad Social. See the plans on pricing, get started at melso.ai or, if you prefer, Message us on WhatsApp.

This article is for information only and does not replace professional advice for your case. Last reviewed: 13 October 2026.