For the complete documentation index, see llms.txt. You can also append .md to any page URL to get its markdown version.
Skip to main content
For the complete documentation index, see llms.txt.

For the complete documentation index, see llms.txt

How to renew PKIo certificates

PKIo certificates have a set expiry date and must be renewed periodically for security purposes. Renewing an expiring certificate requires to update your configuration in the Signicat Dashboard and communicate the change with Logius.

This page outlines the steps to follow when you need to renew an expiring PKIo certificate.

Signicat Support

Signicat Support helps you coordinate certificate renewals and minimise downtime. To ensure a smooth transition, contact us by creating a support ticket in the Signicat Dashboard. In your ticket, inform us about your scheduled change time for certificate renewal. Signicat Support will monitor your traffic and assists you throughout.

1. Create a CSR in the Dashboard​

For the complete documentation index, see llms.txt

A Certificate Signing Request (CSR) contains identifying information about your organisation. When applying for a PKIo certificate, you need to create a CSR that you will then share with one of the Trust Service Providers (TSPs) approved by Logius. These are trusted organisations that verify your CSR and issue PKIo certificates for digital services.

To create a CSR in the Signicat Dashboard, do the following:

  1. Go to Signicat Dashboard > Organisation.
  2. Select the account where to add the CSR.
  3. Under Account management, select Signing Certificates.
  4. Navigate to the Certificate Signing Requests tab, then click the Create CSR button.
  5. Fill in the fields in the Create CSR form:
    Digidentity certificates

    If you purchase the PKIo certificates with Digidentity, you must fill in the organizationIdentifier field in your CSR and provide the same OIN value you used for the Serial number.

  6. Click Create to generate the CSR. After you create a CSR, it becomes readily available in the list under the Certificate Signing Requests tab overview.
  7. To download a CSR, click the kebab menu (three vertical dots) under the Actions column, then click Download to download the .csr file.

A CSR is represented as a Base64 encoded string:

-----BEGIN CERTIFICATE REQUEST-----
...Base64-encoded string...
-----END CERTIFICATE REQUEST-----

Remember that you need to share the CSR with one of the Trust Service Providers (TSPs) approved by Logius when you apply for a PKIo certificate, as explained in the next step below.

2. Purchase a new PKIo certificate​

For the complete documentation index, see llms.txt

What are PKIo certificates?

PKIo certificates are Public Key Infrastructure (PKI) certificates used to cryptographically sign messages between Signicat and the network infrastructure of Logius.

Learn more about PKIo certificates at https://cert.pkioverheid.nl/ and https://www.logius.nl/english/pkioverheid.

PKIo certificates are required to connect to DigiD, DigiD CombiConnect or eHerkenning. To integrate successfully, you need to purchase and configure two separate certificates:

  1. One PKIo certificate for sandbox (preproduction)
  2. One PKIo certificate for production
Lead time

Note that obtaining a new PKIo certificate may take up to five working days.

Supported PKIo certificate types​

The PKIo certificates you purchase must be of one of the following types:

  • Staat der Nederlanden - G4 Root Priv G-Other - 2024 (until 2039)
    • G4 Intm Priv G-Other LP - 2024 (recommended)
  • Staat der Nederlanden Private Root CA - G1 (until 2028)
    • Staat der Nederlanden Private Services CA - G1
  • Staat der Nederlanden Root CA - G3 (until 2028)
    • Staat der Nederlanden Organization Services CA - 2023
    • Staat der Nederlanden Organisatie Services CA - G3

Certificate providers​

You can purchase PKIo certificates from any of the Trust Service Providers (TSPs) approved by Logius. For a list of authorised providers, see the PKIoverheidcertificaat aanvragen page.

Additional requirements for Digidentity certificates

If you purchase your certificates with Digidentity, you must define the organizationIdentifier field in your Certificate Signing Request (CSR). If your CSR does not contain the organizationIdentifier, you need to generate a new CSR before submitting your purchase request to Digidentity.

Purchase checklist

When purchasing PKIo certificates, make sure that:

  1. You only use the Certificate Signing Request (CSR) obtained in the Signicat Dashboard. If you purchase the certificates independently or without the CSR, your integration will fail.
  2. You purchase two separate PKIoverheid (PKIo) certificates: one for the sandbox environment and one for the production environment.
  3. The type of PKIo certificate is one of the Supported PKIo certificate types.

When purchasing a certificate, you should explicitly ask the provider to use the CSR you generated in the Signicat Dashboard.

You can find more instructions to guide you with purchasing PKIo certificates from a trusted provider on the Logius website at PKIoverheid-certificaat aanvragen.

New regulations

The importance of certificates is increasing and regulations around certificates are changing. Learn more about the new generation of PKIo certificates.

3. Upload PKIo certificates in the Dashboard​

For the complete documentation index, see llms.txt

Once you have purchased and received the PKIo certificates from a certificate provider, you need to upload the public part of the certificate (.pem or .cer file extension) to the Signicat Dashboard.

To upload your PKIo certificate to the Signicat Dashboard, do the following:

  1. Go to Signicat Dashboard > Organisation.
  2. Select your account. Make sure to choose the same account you used to create the CSR.
  3. Under Account management, select Signing Certificates.
  4. In the Certificate Signing Requests tab, hover over the row of your CSR and click the kebab menu (three vertical dots) under the Actions column. Then, click Upload Certificate.
  5. In the Upload Certificate dialog, paste the content of your certificate directly in the text box or click the Upload Certificate button and choose the certificate from your local filesystem.
  6. Configure optional fields:
    • Tags: You can categorise your certificate by entering a tag name.
    • Notifications: To notify others in your team, click Add email and provide an email address.
    Email verification required

    Note that the email address need to be verified before notifications can be sent.

  7. To complete the certificate upload, click Confirm.

Alternatively, you can send your certificate to us by creating a support ticket in the Signicat Dashboard or to your assigned onboarding manager by email.

Certificate activation time

Please allow up to 4 hours for the certificates to become active and ready for use. If you require expedited processing, contact us by creating a support ticket in the Signicat Dashboard and request priority handling.

Where to find your PKIo certificates in the Signicat Dashboard

When you upload a PKIo certificate, the (public) PKIo certificate is stored in the Signicat Dashboard. To view your existing certificates, do the following:

  1. Go to Signicat Dashboard > Products > eID and Wallet Hub.
  2. In the left-side menu, navigate to Advanced > Certificates.
  3. Here, you can review your active certificates and access more details, such as issuer and validity window.

4. Get Signicat metadata​

To switch your connection from an expiring PKIo certificate to a new PKIo certificate, you need to share the metadata of the new PKIo certificate with Logius. To do this, you need to complete these steps:

  1. Download a metadata containing the details of the new PKIo certificate.
  2. Submit a change request to Logius to update your connection configuration with the metadata of the new certificate.

The instructions below explain how to achieve this.

Important - Downtime expected

It is important to note that downtime is to be expected, while switching DigiD connections from one certificate to another. This is due to Logius infrastructure design, which supports only one certificate at a time.

As a consequence, your authentication transactions will fail while you are waiting for Logius to update your connection with your new certificate metadata. It is recommended that you inform your end-users promptly.

To minimise downtime while retrieving the metadata for your new PKIo certificate, advanced users can follow the Advanced flow to reduce downtime steps below.

To get the Signicat metadata for your PKIo certificate, do the following

  1. In the Signicat Dashboard, navigate to Products > eID and Wallet Hub > eIDs.

  2. In the left menu, navigate to Advanced > Certificates. Here you can view your active certificates. The active (in use) certificate is marked by the radio button.

  3. Select the new PKIo certificate you intend to switch to and set it to active.

    Important

    While the new PKIo certificate is set to active, transactions with your existing DigiD connection will fail until you set the old (expiring) certificate to active again, as explained in step 7 below.

    To minimise downtime while retrieving the metadata for your new PKIo certificate, advanced users can follow the Advanced flow to reduce downtime below.

  4. In the left menu, navigate to eIDs and choose DigiD from the list.

  5. In the DigiD configuration, click Get Signicat metadata. This opens your metadata, which includes your new PKIo certificate, in a new tab in your browser.

  6. Save the metadata as an XML file. You can do this by right-clicking in the page and selecting "Save as...". Then, save the XML file on your local device.

  7. Important: In the left menu, go back to Advanced > Certificates and switch back to your expiring certificate. This is to minimise downtime while Logius approves your new metadata request.

    Reminder

    Remember to switch back to the expiring certificate as explained in step 7 above. After you switch back to the expiring certificate, your end-users can successfully complete authentication transactions.

Advanced flow to reduce downtime​

You can minimise downtime while retrieving the metadata for your new PKIo certificate by following the advanced guide below.

Note that this will only mitigate downtime to obtain the new metadata. You should still expect downtime while you wait for Logius to update your connection, as explained in 5. Submit change to Logius.

Advanced flow - How to reduce downtime
  1. Obtain the following properties from your new PKIo certificate:
    • SHA 256 fingerprint:
      • openssl x509 -noout -fingerprint -sha256 -inform pem -in <YOUR_PKIO_CERT.pem> | sed 's/SHA256 Fingerprint=//g' | tr -d ':' | tr '[:upper:]' '[:lower:]'
    • Base64 encoded certificate string:
      • sed '/---/d' _.qwant.com.pem | tr -d '\n\r'; echo
    Format guidelines

    Make sure you remove enclosures (-----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----) and any new line character from the certificate string.

  2. In the Signicat Dashboard, navigate to Products > eID and Wallet Hub > eIDs.
  3. In the left menu, navigate to eIDs and choose DigiD from the list.
  4. In the DigiD configuration, click Get Signicat metadata. This opens your existing connection metadata, including your expiring PKIo certificate details, in a new tab in your browser.
  5. Save the metadata as an XML file. You can do this by right-clicking in the page and selecting "Save as...". Then, save the XML file on your local device.
  6. Now, open the XML file with a compatible text editor.
  7. Edit the values of the following XML fields:
    • SPSSODescriptor > KeyDescriptor > KeyInfo > KeyName: Substitute the value with the SHA 256 fingerprint of you new PKIo certificate that you obtained in step 1.
    • SPSSODescriptor > KeyDescriptor > KeyInfo > X509Data > X509Certificate: Substitute the value with the Base64 encoded certificate string of you new PKIo certificate that you obtained in step 1.
  8. Save the metadata file with the new PKIo certificate values. You need to submit this XML file to Logius, as explained below.

5. Submit change to Logius​

To update your DigiD connection with the new PKIo certificate, you need to submit a change request with the metadata file containing your new PKIo certificate details. To do this, you need to fill in a form on the Logius website.

Processing time

Note that it may take a few days for Logius to process the change. You can request the change to occur at a specific time window during office hours.

To submit the change request to Logius, do the following:

  1. Go to https://www.logius.nl/domeinen/toegang/digid/wijzigingsformulier-digid.
  2. Fill in the change form (wijzigingsformulier) with the details of your request and upload the metadata for the new PKIo certificate. For example, fill in:
    • Op welk koppelvlak bent u aangesloten?: SAML
    • Wat is uw wijziging?: Ik wil de metadata vervangen (bijvoorbeeld bij certificaatwissel)
    • Enter the following depending on your scenario:
      • Environment type (omgeving)
      • Date (datum)
      • Time (tijd)
      • Metadata: Provide the XML file with your metadata.
  3. Submit the form to Logius and prepare for switching to the new certificate.
Signicat Support

Signicat Support helps you coordinate certificate renewals and minimise downtime. To ensure a smooth transition, contact us by creating a support ticket in the Signicat Dashboard. In your ticket, specify the scheduled change time you agreed with Logius. Signicat Support will monitor your traffic and assists you during this period.

You can view an example below:

DigiD change form (wijzigingsformulier)

6. Switching to the new certificate​

How to communicate the change

We recommend you communicate the incoming maintenance with your end-users on your website or application. For example, you could display a banner that warns users about potential downtime during the time window you agreed with Logius to update your connection to use the new PKIo certificate.

It is important that you time your certificate switch with Logius to reduce any potential downtime.

When you receive confirmation from Logius and are ready to switch to using the new PKIo certificate, do the following:

  1. In the Signicat Dashboard, navigate to Products > eID and Wallet Hub > eIDs.
  2. In the left menu, navigate to Advanced > Certificates.
  3. Select the new PKIo certificate you intend to switch to and set it to active.

Once activated, your DigiD connection will automatically begin using the new PKIo certificate. Authentication transactions will be using the newly activated PKIo certificate going forward.

Renewal complete!
On this page