For the complete documentation index, see llms.txt. You can also append .md to any page URL to get its markdown version.
Skip to main content
For the complete documentation index, see llms.txt.

For the complete documentation index, see llms.txt

Go to production

Important

To set up DigiD in production, you first need to get your pre-production integration approved by Logius. Make sure you have completed the steps described in the Setup up DigiD pre-production page.

Prerequisites​

To go to production, you must first meet these prerequisites:

1. Create a production account​

To connect to DigiD in production, you need to set up a production account with a custom domain in the Signicat Dashboard. You can always reuse a production account that you created previously. To create a new production account, do the following:

  1. Go to Signicat Dashboard > Organisation.
  2. Click + Add account.
  3. Under Account Name, enter the name of your account, then tick the box for Production account.
  4. Select Create to create the new account.

In the next screen, select Add new domain to add a custom domain and follow the instruction below.

Add a custom domain​

To add a custom domain, follow the instructions for Custom domains. Then, return to this page to continue with the integration.

Custom domain is required

Note that you must add a custom domain. Accounts with a Signicat subdomain (for example, mycompany.app.signicat.com) cannot be used to connect to DigiD.

Using Let's Encrypt certificates

If you wish to use Let's Encrypt certificates as TLS/SSL server certificates for DigiD, you must use a .nl domain. Learn more in the Logius documentation.

2. Upload PKIo certificates​

Order certificates

This step assumes that you have already purchased a PKIoverheid certificate for your production environment. Learn more about it in the Order certificates documentation.

For the complete documentation index, see llms.txt

Once you have purchased and received the PKIo certificates from a certificate provider, you need to upload the public part of the certificate (.pem or .cer file extension) to the Signicat Dashboard.

To upload your PKIo certificate to the Signicat Dashboard, do the following:

  1. Go to Signicat Dashboard > Organisation.
  2. Select your account. Make sure to choose the same account you used to create the CSR.
  3. Under Account management, select Signing Certificates.
  4. In the Certificate Signing Requests tab, hover over the row of your CSR and click the kebab menu (three vertical dots) under the Actions column. Then, click Upload Certificate.
  5. In the Upload Certificate dialog, paste the content of your certificate directly in the text box or click the Upload Certificate button and choose the certificate from your local filesystem.
  6. Configure optional fields:
    • Tags: You can categorise your certificate by entering a tag name.
    • Notifications: To notify others in your team, click Add email and provide an email address.
    Email verification required

    Note that the email address need to be verified before notifications can be sent.

  7. To complete the certificate upload, click Confirm.

Alternatively, you can send your certificate to us by creating a support ticket in the Signicat Dashboard or to your assigned onboarding manager by email.

Certificate activation time

Please allow up to 4 hours for the certificates to become active and ready for use. If you require expedited processing, contact us by creating a support ticket in the Signicat Dashboard and request priority handling.

Where to find your PKIo certificates in the Signicat Dashboard

When you upload a PKIo certificate, the (public) PKIo certificate is stored in the Signicat Dashboard. To view your existing certificates, do the following:

  1. Go to Signicat Dashboard > Products > eID and Wallet Hub.
  2. In the left-side menu, navigate to Advanced > Certificates.
  3. Here, you can review your active certificates and access more details, such as issuer and validity window.

3. Add DigiD in the Dashboard​

You can now add DigiD to your eIDs. To do this:

For the complete documentation index, see llms.txt

  1. In the Signicat Dashboard, navigate to Products > eID and Wallet Hub > eIDs.
  2. Click + Add new in the top right.
  3. Choose the eID from the list. Then, fill in any required configuration and click Add.
  4. Now, review that the eID is available and displayed as Enabled in the eIDs page.

eID configuration​

You can edit the settings of your DigiD connection:

Click to expand

DigiD Dashboard settings

  • Strip sector code from nameID: Logius sends a prefix with the citizen service number (BSN). Some service providers can't handle that. Tick this checkbox to strip away the sector code/prefix.

Advanced configuration

To configure advanced settings, go to the "Advanced" tab in the DigiD page and specify:

  • Select attribute filter: Select an attribute filter to control which attributes you want to include, or exclude, from the response. To create attribute filters in the Dashboard, navigate to Products > eID and Wallet Hub > Advanced > Attribute filters.
  • Include only when scoped: If ticked, the eID will not be visible by default on the eID selection screen, unless you specify it by using IdP scoping.
  • Response attribute mappings: You can customise the name of the attributes received in the response body. Provide none or multiple name-to-name mappings.
  • Use web flow on mobile device: If you are configuring the WEB flow for your connection, you may still want to use it from mobile devices. If you are using the DigiD app, the redirect (in some situations) opens in the mobile device's native browser. In such cases, we need to perform an operation called "session restoration" which may incur in security issues. We have taken a number of mitigations on our side to reduce the risks of such threats. However, some risks cannot be addressed on our side. If you want to use this option, you have to accept such risks. For further information, you can contact us by creating a support ticket in the Signicat Dashboard.
    Mitigating risks

    To fully mitigate the residual risk, we recommend you implement the following on your side: You should only accept a response back from Signicat if you are able to match that response to a request that you have sent earlier. You can achieve this, for instance, by storing the request you have sent in the user session.

Adjust the settings as necessary and click Save to apply the changes.

4. Get Signicat metadata​

To apply for a DigiD connection with Logius, you need the Signicat SAML metadata (in XML format). To download the metadata file:

  1. In the Signicat Dashboard, navigate to Products > eID and Wallet Hub > eIDs.
  2. Select DigiD from the list of eIDs.
  3. Select Get Signicat metadata to download the XML file to your device.

Save the downloaded metadata file locally. You will upload this file to Logius in the next step.

5. Request DigiD in production​

To connect to DigiD production environment, you need to fill in the Logius Aanvraagformulier (Application form).

How to fill in the Logius Aanvraagformulier

When filling in the Logius Aanvraagformulier (Application form), consider the following key fields:

6. Set up a connection with a protocol​

To establish a connection between Signicat DigiD and your application, you need to use an authentication protocol.

Choose a protocol​

For the complete documentation index, see llms.txt

Supported authentication protocols

Signicat supports the standard OpenID Connect (OIDC) and SAML 2.0 protocols. In addition, we offer our bespoke Signicat Authentication REST API.

The protocol you choose depends on your goals and preferences. The Authentication REST API provides flexibility and an easy setup. Otherwise, we recommend OIDC, since SAML 2.0 is much more complex to implement and usually requires a federation agent. OIDC is an industry standard with managed user sessions, unlike the Authentication REST API.

To learn more about these authentication protocols, see the Signicat eID and Wallet Hub documentation.

Set up the protocol​

For information on how to set up the different protocols, see the eID and Wallet Hub - Quick start guide.

Data and attributes​

To learn more about attributes, scopes and claims supported by each authentication protocol, visit the Attributes reference page.

7. Activate your connection​

Submit a request for activation of your connection to the DigiD production environment in the DigiD Wijzigingsformulier. In the form, select "Ik wil mijn productieaansluiting activeren".

8. Ask Logius to approve your connection​

After you set up the connection in production, you need to test it and submit a request for approval by Logius.

9. Audit and assessment​

Your DigiD integration in production should adhere to security standards to ensure secure end-user authentication. Logius performs audits and checks to ensure your infrastructure and connection comply with such requirements.

Your DigiD integration must undergo an official assessment by an external and certified DigiD auditor within two months after going to production.

Additionally, organisations that use DigiD must conduct an annual IT security assessment.

Arrange the audits according to the specifications in the DigiD ICT-beveiligingsassessments guide.

Signicat RSO report

Signicat, as a third-party provisioning service for DigiD, undergoes a Rapporten voor de Serviceorganisatie (RSO, formerly TPM) yearly assessment. For this, we need to plan the RSO audit as early as possible in the year. We can also provide you with Signicat's own DigiD RSO report to use in your audit.

Note that the yearly required assessment planning for municipalities in NL and for DigiD occurs at different times of the year and might lead to some delays. Therefore, we recommend you plan sufficient time around the assessment with municipalities' own audits.

10. Renewing certificates​

When your PKIo certificate is about to expire, you need to renew your certificate and communicate the changes to Logius. Learn how to renew your certificates in the How to renew PKIo certificates guide.

On this page