VeriFactu digital certificate: which one and how to get it

Without a digital certificate there is no VeriFactu. It is what authenticates your submission of invoicing records to the AEAT and, if you choose the “non-VeriFactu” mode (no submission), what signs each record. Here we explain which certificate works, how to get it and how not to be left without it the day it expires.

Digital certificate for VeriFactu, in 30 seconds

• Which one you need: one in the name of the taxpayer who issues the invoices. Self-employed → FNMT natural-person certificate (or DNIe, the Spanish electronic ID card). Company → legal-entity representative certificate.
• Format: a .p12 / .pfx file with the private key inside. It is what you upload to the invoicing software.
• What it is used for: authenticating the submission of records to the AEAT (VeriFactu mode) or signing each record (“non-VeriFactu” mode). Integrity is protected by the SHA-256 hash chain.
• How long it takes: 1 to 3 weeks with the FNMT, because identity has to be verified in person.
• Don’t confuse it with: software “VeriFactu certification”. It does not exist: software complies through a responsible declaration from the producer, not through an AEAT approval.

Which types of certificate work for VeriFactu?

The technical specification (Order HAC/1177/2024) accepts the following types of certificate:

• 🏛️ Natural-person certificate issued by the FNMT (the most common for the self-employed)
• 🏢 Representative certificate for a legal entity or an entity without legal personality (for companies)
• 🪪 Electronic ID card (DNIe) — valid but with practical limitations
• 🏷️ Electronic seal certificate of the company — the AEAT has its own submission addresses for this type; it is common when the submission comes from a company system rather than a specific person
• 🔑 Qualified certificates from other approved providers: Camerfirma, Firmaprofesional, etc.

To upload it to invoicing software you need the file with its private key in .p12 or .pfx format (PKCS#12). A certificate exported with only the public part (.cer, .pem without a key) does not work.

Are “VeriFactu certification” and a digital certificate the same thing?

No, and they are often confused. The digital certificate is the cryptographic file that identifies you or your company to the AEAT: it is issued by the FNMT or another qualified provider and is needed by whoever issues invoices.

The software’s “VeriFactu certification” does not exist as such. The AEAT does not approve or certify invoicing programs: the producer signs a responsible declaration (art. 13 of Royal Decree 1007/2023) stating that its system meets the requirements — chained record with hash, QR code, inalterability, traceability. If a vendor sells you software “certified” or “approved by the AEAT”, ask for the responsible declaration: it is the only document that exists.

How to get the FNMT certificate step by step

1. Request the application code on the FNMT website (sede.fnmt.gob.es). You need a compatible browser and your NIF (Spanish tax ID).
2. Verify your identity in person at an AEAT office, a Social Security office or another accredited registrar. Take your ID card or NIE (foreigner’s ID number). With a DNIe it can be done online, without travelling.
3. Download the certificate from the same browser where you requested it. The FNMT installs it in the browser; export it with the private key to get the .p12 file.
4. Keep the password somewhere safe. Without it you cannot export or use the certificate.

⏱️ The whole process can take between 1 and 3 weeks. Don’t wait until the last moment.

You will find it with screenshots and typical errors in the guide how to request the FNMT certificate, and once downloaded, how to upload it to Cofactu so that it signs and sends.

Can my accounting firm send with its own certificate?

Yes, if it holds a power of representation (apoderamiento). An accounting firm acting as a social collaborator, or with your power of representation registered at the AEAT, can submit the records on your behalf with its certificate, without you handing over yours. Without that power of representation, the AEAT rejects the submission: the NIF on the certificate does not match the issuer of the invoice.

For the firm it is practical — one certificate for the whole portfolio instead of safeguarding each client’s — and for you it means your .p12 doesn’t travel by email. How to register it: authorise your advisor at the AEAT.

How often does the certificate expire?

FNMT certificates are valid for 4 years for natural persons and 2 years for entities. When it expires, you must renew it before it lapses so that invoice submission isn’t interrupted.

A good management system will warn you in advance. In Cofactu, alerts go out at 90, 30 and 7 days before expiry to the owner and the administrators of each organisation, and when renewing you only have to upload the new .p12 over the previous one.

Security: how to store the certificate

The .p12 certificate is the master key to your invoicing. Losing it, or having it fall into the wrong hands, can have serious consequences. Recommendations:

• 🔐 Never send the .p12 file by unencrypted email
• ☁️ If you upload it to a SaaS, check that it is encrypted at rest (AES-256 minimum)
• 💾 Keep an offline backup copy somewhere safe
• 🔑 Use a strong password (at least 12 characters, mixed)

In Cofactu, certificates are encrypted with AES-256-GCM before being stored in Cloudflare R2. The encryption key is never stored with the file.

Keep reading

• How to request the FNMT certificate — step by step, with screenshots.
• How to upload your certificate to Cofactu — encryption, verification and expiry alerts.
• Full VeriFactu guide — software requirements, deadlines and penalties.
• How Cofactu invoices with your certificate — signature, chained hash and QR without you touching anything.
• Accounting firm with dozens of certificates → centralised vault for accounting firms.

Official sources

• FNMT-RCM · Representative certificates — How to get a representative certificate for companies.
• FNMT-RCM · Natural-person certificate — How to get a certificate for the self-employed.
• BOE · Order HAC/1177/2024 — Technical requirements of the certificate for VeriFactu (X.509 v3).
• AEAT · Power of representation — How to authorise your advisor to file on your behalf.