Digital certificate and Cl@ve not working: common errors and fixes

What is failing: choose your problem

• The browser does not show the certificate
• The certificate has expired or been revoked
• The request or download fails
• Cl@ve Permanente (password-based Cl@ve login) is blocked
• Cl@ve PIN (a one-use code) SMS does not arrive
• You need to identify yourself without an appointment
• You want to use the certificate on another device
• You have another common problem

The browser does not show the certificate

The most common cause is that your browser was already open when you installed the certificado digital (digital certificate). Close it fully, then open it again.

Check that the certificate is in the personal store for that browser and the correct computer user. The certificate only exists on the computer where you downloaded it.

Antivirus programmes that scan HTTPS connections, such as Avast or AVG, can block certificate selection. Disable that option or remove the proxy they created. Then restart the computer. On a Mac, remove the proxy in Network settings.

The FNMT browser guidance explains this problem. The FNMT is Spain’s national mint and issues the certificate. This is not a certificate fault.

Expired, revoked or not-yet-valid certificate

The usual problem is trying to renew it too late. Online renewal only works during the 60 days before the expiry date.

You can’t renew online if you have already renewed it once, got it through video identification, or identified yourself with another certificate. In these cases, ask for a new one using in-person verification, video identification, or DNIe. See the FNMT certificate renewal process.

A revoked certificate can never be reactivated. You must ask for a new one. If it says that it is not yet valid, check your computer’s date and time.

Error when requesting or downloading the certificate

The most common cause is changing the computer, browser, or user. You must make the request and download on the same computer, browser, and system user.

First install the Configurador FNMT, the FNMT setup tool. Some antivirus programmes stop it from running.

If the message says that no certificate request exists for the details entered, or that the request code and NIF are not linked, check the code and NIE exactly as you entered them. The NIE must include its first letter. If they do not match, ask for another certificate.

The message that the private key was not found usually means that you made the request on another computer or deleted the browser. In both cases, you must request the certificate again.

After proving your identity in person, the download is usually available about one hour later.

Cl@ve Permanente: forgotten or blocked password

The most common cause is more than five failed attempts. The system blocks the password after five errors.

If you still have the activation code, create a new password through the Cl@ve forgotten-password service. You’ll need your user number, which is your DNI or NIE.

If you lost the activation code, get another one online with an electronic certificate or DNIe. You can also register again at an office.

The password must have at least eight characters, including lower-case letters, capital letters, numbers, and special characters. With 16 characters or more, there are no character-type restrictions. It can’t include your name, surname, or DNI. It also expires after two years.

I don’t receive the Cl@ve PIN SMS

The most common cause is that the registered phone is not your current phone. Check that the ending shown on screen matches your mobile.

If it doesn’t match, update the number online with a certificate or DNIe. You can also do this at a registration office. These include AEAT offices, Spain’s tax agency, Social Security offices, SEPE offices, and Spanish central government offices. Many use cita previa, an appointment booked in advance.

If it matches, try again. Restart your mobile and make space in the SMS inbox. Temporarily disable the phone’s antivirus. Ask your operator whether you can receive these messages.

You don’t need a Spanish phone number for Cl@ve. Foreign mobiles are accepted. The most reliable option is the Cl@ve Movil app, the app for approving Cl@ve logins. Confirm the notification or scan the QR code. This avoids relying on SMS.

If error 66 appears, the service requires registration in person or with a certificate. The basic level is not enough. The system can also block you if you exceed the maximum number of daily attempts.

See the official guidance on missing Cl@ve PIN SMS messages.

Get the certificate or Cl@ve without visiting an office

The quickest option for an FNMT certificate is video identification. It costs 2,99 euros plus tax, but the certificate is free. You’ll receive a reply in about 48 working hours. You don’t need an appointment.

With a DNIe with an active PIN or a valid certificate, you can complete the process online. The FNMT personal certificate is free and lasts four years. An appointment is also free. Don’t pay anyone to get it.

For Cl@ve, automatic video identification through the app gives you the basic level. A public employee’s review gives you the advanced level directly online. This is not a live video call with an official.

With a certificate or DNIe, advanced Cl@ve registration is immediate. Correos does not verify identity for an FNMT certificate. Hacienda and Social Security require an appointment for in-person identity checks.

Use the certificate on another computer or mobile

The most common cause is not having made a backup. From the browser where it is installed, export the certificate as a .pfx or .p12 file. Protect it with a password.

Then import that copy on the other computer or mobile. Make the copy on the same day as the download.

If you have no copy and can’t access the original computer, you must ask for a new certificate.

1. Identify the system. Decide whether the certificate or Cl@ve is failing.
2. Try the original computer. Use the computer, browser, and user where you made the download.
3. Check the basics. Check the expiry date, date, time, and antivirus.
4. Repeat identification. If nothing works, ask for a new certificate or register for Cl@ve again.

What you should have ready

Gather these details before you start. They’ll prevent interruptions during the request or login.

• DNI or NIE, to identify yourself
• FNMT request code, to prove your identity and download the certificate
• Cl@ve activation code, to recover the password
• Registered mobile, to receive alerts or SMS
• .pfx or .p12 copy, to install the certificate on another device

Common problems and how to fix them

AutoFirma will not start

AutoFirma is the Spanish electronic signing app. If it will not start, close the process and open it again. Check that the certificate is installed on that device and that the browser shows it. If the problem continues, see the section about missing certificates.

Personal certificate for a company

The problem is usually the certificate type. A personal certificate identifies one person. It does not prove that they represent a company. Use the correct representative certificate.

Cl@ve PIN expires quickly

The PIN is valid for 10 minutes. If it has expired, ask for another one. Complete the process within that period.

DNIe is not read

The usual causes are an expired DNIe, an inactive PIN, or an unreadable card reader. Check all three before repeating identification.

I changed my mobile

Changing devices stops you confirming requests in the old app. Activate Cl@ve Móvil on the new phone. Update the registered number if you changed that too.

What your digital identity is for

You can use this identity in a sede electronica, an official online government office. You can file your tax return with the AEAT, check work history and pensions with Social Security, manage unemployment with SEPE, check DGT points, read notifications in DEHu, the central electronic notifications mailbox, and check the municipal register in most town halls. Only the certificate allows some Foreigners Office procedures with Mercurio and AutoFirma. It also lets you represent a company.