For the complete documentation index, see llms.txt. You can also append .md to any page URL to get its markdown version.
Skip to main content
For the complete documentation index, see llms.txt.

For the complete documentation index, see llms.txt

Order certificates

Important

To set up DigiD, you first need to complete the Initial preparations. Without following those important steps you may experience delays, technical difficulties or even unnecessary expenses.

1. Create a CSR in the Dashboard​

For the complete documentation index, see llms.txt

A Certificate Signing Request (CSR) contains identifying information about your organisation. When applying for a PKIo certificate, you need to create a CSR that you will then share with one of the Trust Service Providers (TSPs) approved by Logius. These are trusted organisations that verify your CSR and issue PKIo certificates for digital services.

To create a CSR in the Signicat Dashboard, do the following:

  1. Go to Signicat Dashboard > Organisation.
  2. Select the account where to add the CSR.
  3. Under Account management, select Signing Certificates.
  4. Navigate to the Certificate Signing Requests tab, then click the Create CSR button.
  5. Fill in the fields in the Create CSR form:
    Digidentity certificates

    If you purchase the PKIo certificates with Digidentity, you must fill in the organizationIdentifier field in your CSR and provide the same OIN value you used for the Serial number.

  6. Click Create to generate the CSR. After you create a CSR, it becomes readily available in the list under the Certificate Signing Requests tab overview.
  7. To download a CSR, click the kebab menu (three vertical dots) under the Actions column, then click Download to download the .csr file.

A CSR is represented as a Base64 encoded string:

-----BEGIN CERTIFICATE REQUEST-----
...Base64-encoded string...
-----END CERTIFICATE REQUEST-----

Remember that you need to share the CSR with one of the Trust Service Providers (TSPs) approved by Logius when you apply for a PKIo certificate, as explained in the next step below.

2. Purchase PKIo certificates​

For the complete documentation index, see llms.txt

What are PKIo certificates?

PKIo certificates are Public Key Infrastructure (PKI) certificates used to cryptographically sign messages between Signicat and the network infrastructure of Logius.

Learn more about PKIo certificates at https://cert.pkioverheid.nl/ and https://www.logius.nl/english/pkioverheid.

PKIo certificates are required to connect to DigiD, DigiD CombiConnect or eHerkenning. To integrate successfully, you need to purchase and configure two separate certificates:

  1. One PKIo certificate for sandbox (preproduction)
  2. One PKIo certificate for production
Lead time

Note that obtaining a new PKIo certificate may take up to five working days.

Supported PKIo certificate types​

The PKIo certificates you purchase must be of one of the following types:

  • Staat der Nederlanden - G4 Root Priv G-Other - 2024 (until 2039)
    • G4 Intm Priv G-Other LP - 2024 (recommended)
  • Staat der Nederlanden Private Root CA - G1 (until 2028)
    • Staat der Nederlanden Private Services CA - G1
  • Staat der Nederlanden Root CA - G3 (until 2028)
    • Staat der Nederlanden Organization Services CA - 2023
    • Staat der Nederlanden Organisatie Services CA - G3

Certificate providers​

You can purchase PKIo certificates from any of the Trust Service Providers (TSPs) approved by Logius. For a list of authorised providers, see the PKIoverheidcertificaat aanvragen page.

Additional requirements for Digidentity certificates

If you purchase your certificates with Digidentity, you must define the organizationIdentifier field in your Certificate Signing Request (CSR). If your CSR does not contain the organizationIdentifier, you need to generate a new CSR before submitting your purchase request to Digidentity.

Purchase checklist

When purchasing PKIo certificates, make sure that:

  1. You only use the Certificate Signing Request (CSR) obtained in the Signicat Dashboard. If you purchase the certificates independently or without the CSR, your integration will fail.
  2. You purchase two separate PKIoverheid (PKIo) certificates: one for the sandbox environment and one for the production environment.
  3. The type of PKIo certificate is one of the Supported PKIo certificate types.

When purchasing a certificate, you should explicitly ask the provider to use the CSR you generated in the Signicat Dashboard.

You can find more instructions to guide you with purchasing PKIo certificates from a trusted provider on the Logius website at PKIoverheid-certificaat aanvragen.

New regulations

The importance of certificates is increasing and regulations around certificates are changing. Learn more about the new generation of PKIo certificates.

3. Upload PKIo certificates in the Dashboard​

For the complete documentation index, see llms.txt

Once you have purchased and received the PKIo certificates from a certificate provider, you need to upload the public part of the certificate (.pem or .cer file extension) to the Signicat Dashboard.

To upload your PKIo certificate to the Signicat Dashboard, do the following:

  1. Go to Signicat Dashboard > Organisation.
  2. Select your account. Make sure to choose the same account you used to create the CSR.
  3. Under Account management, select Signing Certificates.
  4. In the Certificate Signing Requests tab, hover over the row of your CSR and click the kebab menu (three vertical dots) under the Actions column. Then, click Upload Certificate.
  5. In the Upload Certificate dialog, paste the content of your certificate directly in the text box or click the Upload Certificate button and choose the certificate from your local filesystem.
  6. Configure optional fields:
    • Tags: You can categorise your certificate by entering a tag name.
    • Notifications: To notify others in your team, click Add email and provide an email address.
    Email verification required

    Note that the email address need to be verified before notifications can be sent.

  7. To complete the certificate upload, click Confirm.

Alternatively, you can send your certificate to us by creating a support ticket in the Signicat Dashboard or to your assigned onboarding manager by email.

Certificate activation time

Please allow up to 4 hours for the certificates to become active and ready for use. If you require expedited processing, contact us by creating a support ticket in the Signicat Dashboard and request priority handling.

Where to find your PKIo certificates in the Signicat Dashboard

When you upload a PKIo certificate, the (public) PKIo certificate is stored in the Signicat Dashboard. To view your existing certificates, do the following:

  1. Go to Signicat Dashboard > Products > eID and Wallet Hub.
  2. In the left-side menu, navigate to Advanced > Certificates.
  3. Here, you can review your active certificates and access more details, such as issuer and validity window.
Renewing expiring certificates

When your PKIo certificate is about to expire, you need to renew your certificate and communicate the changes to Logius. Learn how to renew your certificates in the How to renew PKIo certificates guide.

Next step​

To continue your integration, proceed to the guide below:

3. Setup a DigiD in pre-production
Choose a protocol and configure DigiD in pre-production
On this page