Set up your digital certificate
The certificate is what authenticates your invoices' submission and identifies you to the AEAT (Spanish Tax Agency). We tell you which one works, how to upload it securely and how not to be left stranded the day it expires.
- Category
- Compliance
- Level
- Beginner
- Time
- ≈ 6 min
- Steps
- 5
- Updated
- August 2026
Before you start.
What you are about to solve.
The digital certificate authenticates the connection used to submit VeriFactu records to the AEAT. The integrity of each record is protected by its chained hash; in VeriFactu mode no individual XAdES signature is applied to the record.
Any recognised electronic certificate in your name or your company's name works: the FNMT one (natural person or representative of a legal entity), the electronic ID card (DNIe) or any from a qualified provider. In Cofactu you upload it once, it is stored encrypted and it is reused in every submission.
This guide takes you from having the .p12 file on your computer to having it operational and monitored in Cofactu, with alerts before it expires.
Do it in order.
Open only the step you are on.
5 steps to review, issue and leave the document ready, without reading a whole guide at once.
-
Check that you have the right certificate
Step 01: Check that you have the right certificate
You need a certificate in the name of the taxpayer who issues the invoices. If you invoice as a self-employed person, your FNMT natural-person certificate or your DNIe works. If you invoice as a company, you need the legal-entity representative certificate. A public-employee certificate or one belonging to another person does not work for your invoices.
-
Export the certificate with its private key
Step 02: Export the certificate with its private key
The file has to include the private key, not just the public part. From the browser or the system certificate store, export it in PKCS#12 format (.p12 / .pfx), ticking the option to include the private key, and set a password. If you downloaded it from the FNMT it already comes in this format.
- On Windows: Manage user certificates → Export → Yes, export the private key.
- On macOS: Keychain Access → export as .p12.
-
Upload it to Cofactu
Step 03: Upload it to Cofactu
In Settings → Certificates → Add certificate, select the .p12 file and enter its password. Cofactu validates it (readable, valid and the NIF matches your organisation) and stores it encrypted with AES-256-GCM in secure storage. The password is not stored in clear.
-
Check that the signature works
Step 04: Check that the signature works
With the certificate uploaded, issue a test invoice or use the check on the certificate's page. Cofactu verifies the handshake with the AEAT and confirms that the certificate authenticates correctly before you depend on it in production.
-
Turn on the expiry alerts
Step 05: Turn on the expiry alerts
Certificates expire (usually after 2-4 years) and renewing at the last minute is the number one cause of blocked submissions. Cofactu emails you at T-90, T-30 and T-7 days before expiry so you can renew with time to spare. Make sure the organisation's email is correct.
When you finish you will have the certificate uploaded, encrypted and verified, with AEAT submission operational and alerts on so you never find yourself with an expired certificate without noticing.
The questions that come up
when you put it into practice.
Is it safe to upload my certificate to Cofactu?
Yes. The certificate is encrypted with AES-256-GCM and stored in encrypted storage, isolated per organisation. The password is not persisted in clear. It is only used to authenticate your own records and your submissions to the AEAT; it never leaves your organisation.
Can I use my accountant's certificate?
If your accounting firm (gestoría) represents you before the AEAT with a power of attorney, it can sign and file on your behalf from its own firm account. For you to issue directly, you need a certificate in the name of the taxpayer (you or your company).
What happens if my certificate expires?
Submissions to the AEAT will stop completing and invoices will stay pending until you upload a valid one. That is why Cofactu warns at T-90/T-30/T-7: renew before the date and upload the new .p12 so invoicing is not interrupted.
Can I issue without a certificate?
You can prepare drafts, but Cofactu does not offer an issuing mode without submission. To issue through its VeriFactu system you need to set up a valid certificate that authenticates the submission to the AEAT.
Continue from here.
Without losing context.
Related to this task
More Cofactu guides
Compliance≈ 30 min + identity check · Beginner How to request the FNMT digital certificate (Spain) Step-by-step guide to get the FNMT digital certificate (natural person or representative): request, identity verification and download, without getting lost on the way. Open the guide → 
Compliance≈ 10 min · Intermediate How to read an AEAT rejection in VeriFactu What the AEAT error codes (1xxx, 41xx, 5xxx) mean when you send a VeriFactu invoice, how to fix them and how Cofactu repairs the hash chain. Open the guide → 
Compliance≈ 6 min · Beginner How to digitise invoices and what the AEAT requires Digitising expense invoices with OCR is legal and lets you deduct them, but only certified digitisation with approved software lets you throw the paper away. What to keep and for how long. Open the guide → 
