This guide is what worked for us and the people we've helped — it is not legal advice, and we are not legal professionals. Rules change, every situation is different, and the cost of getting it wrong (denied visas, double taxation, fines, missed deadlines) is real.
Before you act on anything here, speak with a qualified legal professional — an immigration lawyer (abogado de extranjería), a cross-border tax accountant, or a licensed gestor — who can review your specific facts. Use this guide to know what questions to ask, not as a substitute for paid advice.
Renewed or replaced certificate, same NIE/DNI and name: you generally install the new certificate and select it when signing in. The official service instructions reviewed describe certificate-based identification, not a nationwide process for uploading each renewed certificate to every agency. Each portal still decides which certificates and security levels its procedures accept. See the Punto de Acceso General identification guide.
New NIE/DNI, legal name, address, phone or email: a new certificate does not automatically correct those details across public services. Update the affected records separately, using each agency's procedure. Moving from NIE to DNI is particularly important: ask agencies to link your existing history rather than create duplicate records.
First certificate ever: use it to access services you already have. It does not enrol you in Social Security, grant healthcare entitlement, register you as self-employed, change your immigration status or file a tax return. Those remain separate procedures.
This guide covers a personal certificate, such as the FNMT-RCM persona física certificate. Company representative certificates and professional systems can have additional enrolment requirements. Need the certificate first? Read Getting Your Digital Certificate in Spain.
Install it where you will use it. A working certificate needs its private key, not just a public .cer file. Restore your password-protected .p12 or .pfx backup into the appropriate browser or operating-system store. Firefox can use a separate certificate store; do not assume an installation visible in one browser is available in every other browser.
Check its identity and dates. Open the certificate details and confirm the holder's NIE/DNI, name and validity period. Run FNMT's certificate-status check before testing other services. An expired or revoked certificate will not work, even if it still appears in the chooser.
Choose the current certificate. Close all browser windows and reopen before testing if the browser keeps presenting the old one. Identify the new certificate by its dates and serial number. Once the new one works and has a tested backup, remove obsolete copies from the stores you actually use; deleting a local copy is not the same as revoking it.
Make a fresh encrypted backup. Export with the private key, choose a strong password, store it securely and test importing it on a second device. Never upload the private-key file to an agency as a profile attachment or send it to an adviser. Use authorised representation instead of sharing your identity.
AEAT's certificate-status guidance explains invalid certificates; our certificate maintenance guide covers backups, moving devices, renewal and revocation. Renewing your physical TIE with the same NIE is not, by itself, evidence that your digital certificate has stopped working — verify its status and identity details.
**Open Importass and access your personal area.** Choose digital certificate where offered and select the new certificate. Importass help lists the available identification methods; individual procedures can have different requirements.
Confirm you are looking at your existing record. Check your name, NIE/DNI and Social Security number (NUSS/NAF). Open your employment history (vida laboral) or another read-only record. A routine certificate replacement is not a reason to request a new Social Security number or re-register as autónomo.
**Correct actual changes in Datos personales.** The service covers contact/address information, corrections to personal data and communicating a change from NIE to DNI. Follow the documents and identification requirements displayed for the chosen change; the NIE-to-DNI procedure requests the NIE support number.
**If you use benefits or pension services, also test Tu Seguridad Social.** Verify the information relevant to your case. A missing benefit or an empty record is not proof that your certificate needs registration: check whether the agency still has your previous identification number and contact it through its official support channel.
Save evidence of any update. Keep the submission receipt/reference and check the amended details after the request is processed. If you have an employer or gestor, tell them about an actual identity-number change; do not hand over your certificate backup.
Keep three things separate: your entitlement to public healthcare, your regional health-card record (tarjeta sanitaria), and your login to the patient portal. Receiving a new certificate does not create or cancel entitlement, replace your health card, or transfer clinical records.
Find your region's official portal. The Ministry of Health regional access directory links to the autonomous-community health services. Use the identification method that your region offers — some accept a certificate, some offer Cl@ve, and others use their own patient-access credentials. Do not expect one nationwide login or one certificate-update form.
**In Catalonia, start with La Meva Salut.** Try its current digital-certificate access option if offered. If your name, NIE/DNI, address, phone or email has changed, follow CatSalut's health-card information and your primary care centre (CAP) instructions to amend the patient record. Certificate renewal alone is not a reason to request a replacement TSI.
Elsewhere, use your regional health service or health centre. The Ministry's health-card guidance confirms that the competent regional administration, or INGESA where applicable, manages the card. Ask which documents are required for an identity or address correction; these requirements are not identical across Spain.
Check continuity after a genuine identity change. Ask the health service to retain/link your existing patient identifier and history. Confirm your assigned centre, appointments, prescription access and contact details. If records are missing, contact the service rather than creating a second patient account. If entitlement also changed, resolve that separately with the responsible agency.
Private insurer portals normally use their own account credentials. A public digital-certificate renewal is not an instruction to cancel or re-enrol in insurance. For the broader distinction, see Healthcare in Spain.
**Go to the Agencia Tributaria electronic office and choose certificate/DNIe where offered.** AEAT identification guidance describes certificate access. Test a read-only service and check that it identifies you correctly; you do not normally register the replacement personal certificate with the tax agency.
Review your identification and tax address. If those details changed, use the applicable census procedure. Modelo 030 is used for certain personal census and tax-address changes; people on the business/professional census may need Modelo 036. Use the current official instructions or your adviser to decide which applies — do not submit both simply because the certificate is new.
Check representation and notifications separately. Review your existing authorised representatives and notification contacts if your identity or contact details changed. A certificate replacement does not itself file tax changes or give an adviser permission. Save the receipt for any census update and confirm the result in your tax record.
**Driving and vehicles — DGT.** Use the access method offered by the relevant service and check your licence information. If your address, name or identification changed, use the corresponding procedure. DGT has a separate vehicle-holder data-change procedure; do not confuse changing records with renewing the login certificate.
**Benefits — SEPE electronic office.** Select a recognised certificate or another accepted identity method for your procedure and confirm access to your existing benefit record. If contact or identity details changed, communicate them using the procedure applicable to your benefit. Some signing operations require AutoFirma.
Job-seeker registration — your autonomous-community employment service. This is not the same as SEPE benefit administration. Check your demandante de empleo record and any upcoming renewal date through your regional service. A new certificate does not renew your job-seeker registration or suspend existing obligations.
Town hall — your municipality's official electronic office. Test access to your existing padrón record. A move or personal-data change needs a separate local procedure; certificate renewal does not report a new address. For example, Madrid lists its own padrón procedures. See our empadronamiento guide for context.
Banks, utilities and private services. Use their normal customer channels for identity/address corrections. They do not all accept the public certificate as a login, and updating one organisation does not update the others. Do not send anyone your .p12/.pfx file or its password.
**Test DEHú and the notification inboxes of agencies you use.** Review pending messages and your alert email. Alert emails are a convenience; consult the official inbox and follow each notice's deadline. Certificate renewal does not restart a response period.
**Check Mi Carpeta Ciudadana.** Confirm access to available records and pending matters. It aggregates participating services, not every record held anywhere in Spain, so also check the responsible agency directly.
Do not resubmit an existing application because you renewed the certificate. Use your receipt or case number to view it. If the portal cannot associate your case after an NIE-to-DNI change, ask the responsible office how to link the old and new identity records.
Review powers of attorney if relevant. Use the AEAT electronic office or the Registro Electrónico de Apoderamientos for the required scope of representation. A gestor should use their own authorised identity; your private key is not a document they need to keep.
No certificate offered: check that the current certificate and private key are installed in the browser/device you are using. Try the portal's supported browser and restart it. Do not upload the backup to a form to make it visible.
Expired or revoked error: verify the selected certificate through FNMT. If the current one is invalid, follow the issuer's replacement instructions. A listed but invalid certificate is not a working credential.
Login works but signing fails: consult the procedure's signing requirements, install/update AutoFirma from the official site if required, and allow the legitimate application hand-off. A successful login is not proof that a signature was submitted; look for the final receipt.
Wrong identity or empty records: compare the certificate's NIE/DNI with the identifier held by that agency. After an identity-number change, ask the agency to reconcile the records. Do not request duplicate Social Security or healthcare registration as a workaround.
Only one portal fails: check its accepted identification methods and service notices. Use Cl@ve or another official method only if that procedure offers it. Save the error and time without exposing private keys or unnecessary personal information, then contact the agency. If a deadline is near, use the officially permitted alternative submission or representation route; a screenshot alone does not extend a deadline.
Certificate: current identity and dates checked; status verified; private-key backup encrypted and restore tested; obsolete local copies removed only after the replacement works.
Social Security: existing NUSS/NAF and employment/benefit records visible; actual personal/contact changes submitted; confirmation retained.
Healthcare: correct regional portal opens; existing patient/health-card identifier preserved; actual changes communicated to the regional service or centre; appointments and prescription access checked.
Other services: tax details reviewed; relevant DGT, SEPE, regional job-seeker and municipal records checked; changed details reported through the appropriate procedures.
Notifications and applications: agency inboxes checked; alert contacts correct; existing cases and representation reviewed. Keep a secure note of each service checked, the date, any outstanding correction and its receipt number — never include certificate passwords in that checklist.
If nothing about your identity or contact details changed and all your portals work, you are done. There is no reason to create replacement accounts simply because you have a new certificate. Return to all Spain guides or contact us with a question about this guide; do not send certificate files or medical records.