> I mean that roughly every year I have to see what's up with the certificates on my dad's computer as he complains he cannot log in anymore to AEAT, at first I

> I mean that roughly every year I have to see what's up with the certificates on my dad's computer as he complains he cannot log in anymore to AEAT, at first I assumed he misconfigured something but nope it's the public certificate of the root or subordinate CAs that have to be changed as the previous ones are revoked Are you sure? As far as I know, your OS doesn't need to recognise the root certificate to authenticate yourself towards a web-server, the web-server needs to know it. At least when I was working with client certificates, I was working with a self-signed one, and I didn't need to register my CA, I just dropped it with the web-server, which was doing the validation. I tried it now with a MacOS, and the certificate is marked as not trusted, but I can present it to the server, and it validates it. > Indeed, the "personal" certificate is invalidated each 4 years and you have to visit the police to get a new one. As I read it, you can renovate it online 60 days before expiry: https://www.sede.fnmt.gob.es/en/certificados/persona-fisica/renovar https://www.sede.fnmt.gob.es/en/certificados/persona-fisica/... Also rather with the AEAT, if you prefer.