Sooner or later, almost every task in Spanish officialdom moves online — and when it does, the system asks you to prove who you are. The certificado digital is the file that does that. This guide explains what it is, what you can actually do with it, the exact FNMT process from request to installation, how Cl@ve compares as the alternative, and the practical problems expats most often hit along the way.
A Spanish certificado digital — sometimes called a certificado electrónico — is a small digital file containing your identifying details, issued by a recognised certification authority. Once installed on your device, Spanish public administrations can be confident that the person on the other end of an online form really is you. Spain's own central administration portal describes an electronic certificate as a digital document containing your identifying data that lets you identify yourself online and exchange information securely with public bodies.
Source: administracion.gob.es — Obtención del Certificado Electrónico de la FNMT.
For individuals, the version almost everyone means is the Certificado de Persona Física issued by the FNMT-RCM — the Fábrica Nacional de Moneda y Timbre, Spain's national mint, which also acts as a certification authority. It used to be called the Certificado de Ciudadano, a name you will still see in older documents and in the FNMT's own help pages.
Technically, the certificate is a software file that lives in your browser's or operating system's certificate store. That detail is the root of most of the frustration people experience: a certificate is not an account you log into from anywhere, it is a file on a specific machine. Change computer, reinstall your operating system or switch browsers without exporting it first, and you can find yourself locked out.
There are other ways to identify yourself electronically in Spain. The DNI electrónico does the same job but is only available to Spanish nationals. The Cl@ve system, covered below, works with codes and passwords rather than an installed file. EU citizens can sometimes use their own country's electronic identity through the EU's cross-border eIDAS arrangements, which the Spanish tax agency lists among its accepted identification methods.
Source: Agencia Tributaria — Identificación electrónica.
According to the FNMT, any Spanish or foreign citizen of legal age — or an emancipated minor — holding their DNI or NIE may obtain a digital certificate free of charge. Being a foreigner is not a barrier. What you need is a valid Spanish identification number and the documentation to back it up: for most expats, a NIE plus a passport or home-country identity document.
Source: Sede Electrónica FNMT — Certificado de Persona Física.
If you do not yet have a NIE, that is the first thing to sort out. Our guide to NIE vs TIE in Spain explains the difference between the number itself and the physical residence card, and why people so often confuse the two when filling in official forms.
Strictly speaking, no single law says a foreign resident must hold a digital certificate. In practice, life in Spain becomes dramatically easier with one and increasingly awkward without. A growing number of processes are online-first or online-only, and an expat without a certificate ends up queueing for appointments that a certificate holder completes in five minutes at the kitchen table. It is also how you reach your own records: tax certificates, social security reports and padrón certificates are all downloadable in seconds once you can identify yourself online.
Spain's central administration portal lists a broad range of uses for the electronic certificate, including filing and paying taxes, submitting complaints and claims, consulting the municipal register, checking traffic fines, applying for grants and subsidies, and signing documents digitally.
Source: administracion.gob.es — Obtención del Certificado Electrónico de la FNMT.
Translated into the everyday reality of an expat in Spain, the certificate typically unlocks:
The FNMT breaks the process for the software Certificado de Persona Física into four stages, which must be done in order. Doing part of it on a different device is the single most common reason applications fail.
Source: Sede Electrónica FNMT — Certificado de Persona Física.
Before you request anything, prepare the machine you will use. The FNMT specifies the latest version of one of the mainstream browsers — Firefox, Chrome, Edge, Opera or Safari — and requires you to install its helper application, the Configurador FNMT-RCM, which generates the cryptographic keys behind the certificate.
The same page carries three warnings worth reading twice. Do not reformat the computer between requesting and downloading. Carry out the whole process from the same machine and user account. And read the certification practices statement first. The FNMT also notes that antivirus software and proxy configurations can interfere with the configurator.
Source: Sede Electrónica FNMT — Configuración previa.
With the configurator installed, you complete the online request form on the FNMT's electronic office, entering your identification number, your first surname exactly as it appears on your documentation, and an email address. The system then sends a código de solicitud — a request code — to that address.
That code is the thread that ties the whole process together. You will be asked for it at the registration office, and again when you come to download the certificate. Save the email; do not simply rely on finding it later in a crowded inbox.
This is the one step you cannot do from your sofa, at least not for free. You must present yourself at an oficina de registro with your request code and identification documents so that a human being can confirm you are who the application says you are.
The FNMT states that offices of the AEAT (the tax agency) and the Seguridad Social, among others, require an appointment — a cita previa — for this. In busy provinces those appointments can be scarce, so book as soon as you have your request code rather than leaving it until the week you need the certificate.
Source: Sede Electrónica FNMT — Acreditar la identidad.
There is also a remote alternative: Spain's central administration portal notes that while the certificate is free, video identification carries a fee — quoted at the time of writing as €2.99 plus taxes. Check the current terms on the official site before relying on it, and note that a certificate obtained this way is treated differently at renewal.
Source: administracion.gob.es — Obtención del Certificado Electrónico de la FNMT.
Once your identity has been accredited, you return to the FNMT site — same computer, same browser, same user account — enter your details and request code, and download the certificate. It installs into the certificate store, and from then on you are prompted to select it whenever a government site asks you to identify yourself. Make a backup copy straight away, as covered below.
The FNMT sets out different documentation depending on your nationality. In every case, the request code sent to your email is mandatory — turning up without it means turning around again.
The request code, plus the DNI, passport or driving licence.
The request code, plus documentation showing the NIE together with a passport or identity document from the country of origin. The FNMT accepts the foreigner identification document showing the NIE, or the EU citizen registration certificate showing the NIE, in each case accompanied by the passport or home-country ID.
The request code, plus the foreigner identification card — the FNMT refers to the tarjeta roja, verde or blanca — showing the NIE, together with the passport; or official NIE documentation together with the passport.
Source: Sede Electrónica FNMT — Acreditar la identidad.
Running alongside the certificate is Cl@ve, described on its official site as a system for identifying yourself electronically in dealings with public administrations. Where the certificate is a file on a specific device, Cl@ve is closer to an account: register once, then identify yourself using codes or a password rather than something stored in your browser.
Source: Cl@ve — official portal.
Cl@ve PIN is the lighter-touch option: a way of carrying out procedures online with a credential of limited validity in time, configured as a single-use key. The official site recommends the Cl@ve PIN mobile application to obtain it. In practice it suits occasional users — someone checking a tax file once a year rather than dealing with the administration weekly.
Source: Cl@ve — Cl@ve PIN.
Cl@ve Permanente is an authentication system using a username and password as the parameters for verifying your identity. It suits people who use online administration regularly and would rather not request a fresh code every time. The official pages set out specific password requirements and separate procedures for managing the credential.
Source: Cl@ve — Cl@ve Permanente.
You will also see Cl@ve Móvil referenced by some administrations, including the tax agency, which describes it as a way to identify yourself in electronic procedures without remembering complex passwords or installing certificates, by scanning a QR code from the Cl@ve app.
Source: Agencia Tributaria — Identificación electrónica.
Cl@ve registration comes in two levels, basic and advanced, with different routes into each. The official registration page lists registering over the internet with automatic video identification or via an invitation letter as the basic-level routes, and registering over the internet with manual video-identification review, with an electronic certificate or DNIe, or in person at a registration office as the advanced-level routes. It also notes that a basic-level registration is not valid for every service and restricts access to Cl@ve Firma.
Source: Cl@ve — ¿Cómo puedo registrarme?.
Both systems are official, both are widely accepted across the Spanish administration, and neither is universally better. The table sets out the practical differences as described by the official sources. Availability and accepted uses vary by administration, so treat it as orientation rather than a rulebook.
| Feature | Certificado digital (FNMT) | Cl@ve |
|---|---|---|
| What it is | A certificate file installed on your device, issued by the FNMT-RCM | A state identification system using codes (Cl@ve PIN) or a username and password (Cl@ve Permanente) |
| Where it lives | In your browser or operating system certificate store, on a specific machine | Registered centrally; used via app, code or password from any device |
| Cost | Free for individuals; video identification carries a fee | Free to register |
| Identity check | In person at a registration office, or by video identification | Video identification, invitation letter, an existing certificate or DNIe, or in person |
| Registration levels | Single certificate type for individuals | Basic and advanced levels; basic is not valid for all services |
| Electronic signature | Yes — signs documents and submissions | Cl@ve Firma exists but is restricted at basic registration level |
| Portability | Must be exported and imported to move between devices | Usable from any device once registered |
| Renewal | Renewal window of 60 days before expiry; conditions apply | Credential management handled through the Cl@ve system |
| Best suited to | Regular users, anyone signing documents, people managing tax or business affairs | Occasional users, phone-first users, people who move between devices |
Sources: Sede Electrónica FNMT, FNMT — Renovar certificado and Cl@ve — registration methods.
Once installed, the certificate appears in your browser's or system's certificate store and is offered automatically when a government website requests identification. The important work now is protecting it.
Exporting the certificate produces a backup file that includes the private key, and the FNMT is clear that it should be kept somewhere safe. You set a password on the file when you export, and you will need that password to import the certificate elsewhere — so it must be remembered.
The FNMT maintains step-by-step FAQs covering exporting, importing and deleting certificates in each major browser. Follow those, because menu paths differ between browsers and change between versions.
Source: FNMT — Exportación, importación y eliminación de certificados.
If you replace your laptop you do not need to reapply — you import the backup file into the new machine and carry on. This is the strongest argument for making the backup on day one: without it, a new computer means starting the whole four-step process again, including a fresh trip to a registration office. Certificates can also be installed on phones and tablets, though the process is fiddlier and varies by operating system; this is one area where Cl@ve is genuinely more convenient.
Digital certificates do not last forever. Each carries its own expiry date, visible in the certificate's details in your browser or certificate store — and that is the date to work to, rather than any number quoted second-hand.
The FNMT states that renewal of the Certificado de Ciudadano can be carried out during the 60 days before the expiry date. That window matters, because the renewal route is far less painful than starting again: in many cases it can be completed online without returning to a registration office.
There is an important exception. The FNMT specifies that if the certificate you now want to renew was obtained by identifying yourself with another digital certificate, with a DNIe, by video identification, or if it has already been renewed once before, a new certificate cannot be issued without accrediting your identity in person again.
Source: Sede Electrónica FNMT — Renovar certificado.
The certificate has a reputation among expats for being fiddly, and it is not undeserved — but most of the trouble comes from a handful of predictable issues, nearly all avoidable if you know about them in advance.
The FNMT requires a current version of a supported browser plus its Configurador FNMT-RCM application, and warns that antivirus software and proxies can interfere. Corporate laptops, aggressive security suites and VPNs are common culprits. The usual fixes: update the browser, disable a proxy, allowlist the FNMT application in your antivirus, and retry with administrator rights available.
Source: Sede Electrónica FNMT — Configuración previa.
This is the classic failure. Request and download must be completed on the same computer, browser and user account, and the machine must not be reformatted in between. If weeks pass before your registration-office appointment, go back to the original machine to download — otherwise you start again.
Spanish records expect a first surname and often a second, a structure many nationalities do not share. Problems arise with a single family name, a double-barrelled name, a middle name recorded inconsistently, or accents transliterated differently on different documents. If the name in your request does not match the name held against your NIE, the identity check can fail.
The fix is to be boringly consistent: enter your name exactly as it appears on the official documentation carrying your NIE, character for character. If your records are inconsistent between documents, correct that at source before applying.
A NIE consists of a letter, seven digits and a final check letter, and it must be entered in the format the system expects. Typing it with spaces, hyphens or a missing leading zero is a frequent cause of a form simply refusing to proceed. If a form rejects your number, check the exact characters against your NIE documentation rather than assuming the site is broken.
The FNMT notes that AEAT and Seguridad Social offices, among others, require a cita previa. In popular expat areas the appointment slot is the real bottleneck, not the paperwork. Book as soon as you have your request code, check several offices rather than only the nearest, and confirm the office handles FNMT accreditation before travelling.
Sometimes the certificate installs but a website does not offer it. Usual causes: it was imported without the private key, it landed in the wrong part of the certificate store, or your browser does not read the store you installed it into — Firefox, for example, keeps its own store separate from the operating system's. The FNMT's export and import FAQs address these browser by browser.
The certificate rarely arrives on its own. It sits in the middle of a cluster of tasks new arrivals work through in their first months, and the order you tackle them in makes a real difference.
You need a Spanish identification number before you can request a certificate, because the certificate is issued against it. For most foreign residents that means the NIE. Our guide to NIE vs TIE explains which one you have and what each is for.
Registering on the municipal roll does not require a certificate, but a growing number of town halls issue the resulting certificado de empadronamiento online — and that document is itself required for many other processes. See our empadronamiento and padrón guide.
Opening an account does not normally need a certificate, but a Spanish account makes anything involving payments or refunds far less awkward. Our guide to opening a bank account in Spain covers what banks typically ask for.
The DGT's online services are one of the most common reasons expats finally get around to obtaining a certificate. If you are working through exchanging your driving licence, check which parts of the process your situation allows you to complete online.
Access to public healthcare depends on your status — employment, self-employment, an S1 or a specific residency route — not on holding a certificate. But once you are in the system, the certificate or Cl@ve is often how you book appointments and manage prescriptions. Our guide to how Spanish public healthcare works sets out who is entitled to what.
British arrivals now go through the non-EU route, which changes the documentation the FNMT expects at the identity check. Our guide to moving to Spain from the UK puts the certificate in sequence alongside visas, residency and healthcare.
Europe is moving towards a common digital identity framework, under which member states are to make an EU Digital Identity Wallet available — a smartphone-based way of proving who you are and sharing official attributes across borders.
It is a genuine direction of travel, and Spain participates in EU-level electronic identification arrangements already: the tax agency, for example, lists eIDAS among the identification methods it accepts, which allows citizens of other member states to identify themselves using their own country's electronic identity.
Source: Agencia Tributaria — Identificación electrónica.
What we deliberately will not do is put dates on it. Implementation timetables for cross-border digital projects move, and the practical question — what your town hall or provincial office will actually accept next spring — is not answered by a European framework document. For now, the certificado digital and Cl@ve remain the two systems that reliably work across the Spanish administration, and both are worth having.
The digital certificate and your health cover are separate things, but they meet at several points in the expat admin journey — which is why this question comes up so often on a health insurance site.
If you are applying for a Spanish visa or residency permit as a non-EU national, the requirement that usually applies is comprehensive private health insurance from an insurer authorised in Spain, without co-payments, valid for the period of the application. That is about the policy, not about how you identify yourself online — a certificate will not make an unsuitable policy acceptable.
Where they connect is in the running of things afterwards. Once resident, the certificate or Cl@ve is how you deal with the tax agency, the Seguridad Social and your regional health service online — and many people entitled to public healthcare still add private cover to avoid waiting lists and to have English-speaking support. Our guide to comprehensive health insurance in Spain explains what "comprehensive" means in Spanish policy terms and how it differs from basic or co-payment cover.
Acceptance, terms and pricing depend on your circumstances, so the practical step is a personalised quote rather than a headline figure. Our English-speaking Sanitas advisers can walk you through the options — get a quote or talk to our team.
Whether you need visa-compliant cover for a residency application or private healthcare to avoid the public waiting lists, our English-speaking Sanitas advisers make it simple. Get a personalised quote in minutes.
Get a Quote →Yes. The FNMT states that any Spanish or foreign citizen of legal age, or an emancipated minor, holding a DNI or NIE may obtain the digital certificate free of charge. The one cost to note is video identification, which Spain's central administration portal says carries a fee — quoted at the time of writing as €2.99 plus taxes — if you choose to accredit your identity remotely rather than at a registration office. Always confirm current terms on the official FNMT site before applying.
Yes. The FNMT provides for both EU and non-EU foreign citizens. EU citizens present documentation showing the NIE with a passport or home-country ID. Non-EU citizens present the foreigner identification card showing the NIE with a passport, or official NIE documentation with a passport. In every case you also need the request code emailed to you. Individual offices can ask for more, so check before you travel.
The certificado digital is a file issued by the FNMT and installed on a specific device, used to identify yourself and sign documents electronically. Cl@ve is a state identification system used through codes or a username and password, with Cl@ve PIN as a single-use, time-limited credential and Cl@ve Permanente as a password-based option. Cl@ve is more portable; the certificate is generally stronger for signing and heavier administrative use. Many residents hold both.
Identity accreditation is normally done in person at an oficina de registro, and the FNMT notes that offices of the AEAT and Seguridad Social, among others, require an appointment (cita previa). There is also a video identification route, which carries a fee and which affects how the certificate can later be renewed. If you can reach an office reasonably easily, the in-person route is the more straightforward option.
Yes, by exporting a backup copy from the machine where it was installed and importing it on the other device. The export must include the private key and is protected by a password you set. The FNMT publishes step-by-step instructions for each major browser. Because the backup file effectively is your digital identity, store it securely and never share it.
Each certificate carries its own expiry date, which you can read in the certificate details in your browser or certificate store — that is the figure to work from rather than any number quoted informally. The FNMT states that renewal can be carried out during the 60 days before the expiry date. It also specifies that if the certificate was obtained by identifying yourself with another certificate, with a DNIe, by video identification, or if it has already been renewed once, a new certificate cannot be issued without accrediting your identity in person again. Check the FNMT renewal page for the conditions that apply to you.
The most common causes are doing part of the process on a different computer, browser or user account; reformatting the machine between request and download; a name that does not match the records held against your NIE; entering the NIE in the wrong format; or antivirus software or a proxy blocking the FNMT configurator. Working through those points in order resolves most failures.
Not as a formal requirement in itself. You can register on the padrón at your town hall in person, and residency applications are assessed on the documentation you submit. What a certificate does is make many of the surrounding steps easier — requesting a padrón certificate online, downloading tax or social security documents, and checking the status of files — and some administrations now handle certain submissions electronically. Requirements vary by office, so always check with the body you are dealing with.
Europe is moving towards a common digital identity framework, and Spain already participates in cross-border electronic identification through eIDAS, which the tax agency lists among its accepted identification methods. We would not put a date on wider implementation, because timetables for projects of that scale change. For now, the certificado digital and Cl@ve remain the two systems that work reliably across the Spanish administration.
No. Entitlement to public healthcare depends on your status — employment, self-employment, an S1 or reciprocal arrangement, or a particular residency route — not on holding a certificate. What the certificate or Cl@ve does is let you use your regional health service's online systems once you are registered, for things like appointments and prescriptions. Non-EU visa applicants normally need comprehensive private health insurance without co-payments as part of the application, and many residents keep private cover alongside public healthcare to avoid waiting lists. Our English-speaking advisers can help — get a quote.