3 ms·

Thanks for the tips and clarifications. > It is not needed yearly. The validity is 4 years for "personal" certificates: Indeed, the "personal" certificate is

by pa7x1 6y ago

Thanks for the tips and clarifications. > It is not needed yearly. The validity is 4 years for "personal" certificates: Indeed, the "personal" certificate is invalidated each 4 years and you have to visit the police to get a new one. What I meant is that the root (or subordinates) certificates of the FNMT are revoked with a surprisingly high frequency. With "yearly" I mean that roughly every year I have to see what's up with the certificates on my dad's computer as he complains he cannot log in anymore to AEAT, at first I assumed he misconfigured something but nope it's the public certificate of the root or subordinate CAs that have to be changed as the previous ones are revoked. This is done with a noticeably higher frequency than needed. This has happened several times and always leaves me baffled as what could be the reason.

yokaze 6y ago
> I mean that roughly every year I have to see what's up with the certificates on my dad's computer as he complains he cannot log in anymore to AEAT, at first I assumed he misconfigured something but nope it's the public certificate of the root or subordinate CAs that have to be changed as the previous ones are revoked Are you sure? As far as I know, your OS doesn't need to recognise the root certificate to authenticate yourself towards a web-server, the web-server needs to know it. At least when I was working with client certificates, I was working with a self-signed one, and I didn't need to register my CA, I just dropped it with the web-server, which was doing the validation. I tried it now with a MacOS, and the certificate is marked as not trusted, but I can present it to the server, and it validates it. > Indeed, the "personal" certificate is invalidated each 4 years and you have to visit the police to get a new one. As I read it, you can renovate it online 60 days before expiry: https://www.sede.fnmt.gob.es/en/certificados/persona-fisica/renovar https://www.sede.fnmt.gob.es/en/certificados/persona-fisica/... Also rather with the AEAT, if you prefer.

by pa7x1 6y ago

yokaze 6y ago

> I mean that roughly every year I have to see what's up with the certificates on my dad's computer as he complains he cannot log in anymore to AEAT, at first I assumed he misconfigured something but nope it's the public certificate of the root or subordinate CAs that have to be changed as the previous ones are revoked Are you sure? As far as I know, your OS doesn't need to recognise the root certificate to authenticate yourself towards a web-server, the web-server needs to know it. At least when I was working with client certificates, I was working with a self-signed one, and I didn't need to register my CA, I just dropped it with the web-server, which was doing the validation. I tried it now with a MacOS, and the certificate is marked as not trusted, but I can present it to the server, and it validates it. > Indeed, the "personal" certificate is invalidated each 4 years and you have to visit the police to get a new one. As I read it, you can renovate it online 60 days before expiry: https://www.sede.fnmt.gob.es/en/certificados/persona-fisica/renovar https://www.sede.fnmt.gob.es/en/certificados/persona-fisica/... Also rather with the AEAT, if you prefer.