Renewing Spain's digital certificate: the online process that fails in Chrome and Edge

Renewing the digital certificate: impossible in Chrome, an ordeal in Firefox

The FNMT digital certificate has become a maze for thousands of people who simply want to deal with the Spanish public administration. Online renewal, which should take two minutes, gets stuck in the two most widely used browsers on the market —Chrome and Edge— and forces users to fall back on Firefox or the old Internet Explorer, depending on the case, as complaints pile up as the expiry date approaches. The result: people who give up and switch to Cl@ve PIN.

There is a technical explanation for the paradox, though it offers little comfort. Chrome and Edge do not support the components used by the FNMT, and the same goes for Flash or Java. It is a matter of browser security, not a whim of the ministry. But citizens who reach the electronic office are met with a blunt message: "No active certificate matches the requested operation." Nobody tells them that they may be using the wrong browser, that they are missing the Autofirma program, or that their certificate has already been renewed once and cannot be renewed again.

The error nobody explains: online renewal is only allowed once

This is one of the most common traps. The digital certificate can only be renewed online once; the second time requires appearing in person at a registration office. The system, however, does not warn users: it returns the same generic error as if the certificate had expired or were badly installed. Several affected users agree that they wasted hours before discovering that the problem was not their computer, but that they had already used up their online renewal.

The most widely recommended workaround is to install the FNMT configurator and use Internet Explorer, the browser Windows ships with by default and which almost nobody uses for anything else. With it, the certificate download and installation process works automatically in most cases. Afterwards, the certificate can be exported to Firefox or Chrome for everyday use. Some people even resort to a 32-bit portable version of Chrome to complete the download when everything else fails.

The quick route: book an appointment and start from scratch

When online renewal proves impossible, the alternative is to request a new certificate at an authorised office. The in-person procedure cancels the old certificate and issues a new one that is installed just like the first time. Registration offices —Government sub-delegations, municipal offices, Tax Agency headquarters— often accept applications without an appointment, and the process is quick if there is no queue.

The underlying problem is that the administration has built a system that works, but only if the citizen gets the browser, the helper program, the computer and the number of previous renewals right. Cl@ve PIN and Cl@ve Permanente (Spain's alternative digital ID systems) already cover a good part of routine procedures —income tax, employment history, Social Security enquiries— without needing a certificate. For many, that is the way forward.

One question remains unanswered: if digital banking solves identification with a PIN and an SMS, why does the administration keep demanding an ecosystem of programs and browsers that fails more often than it works? The most plausible prediction is that the certificate will linger on, dragging its patches along, while Cl@ve gains ground through sheer convenience. Though nobody bets on the FNMT admitting it.