Spain's AEAT E-Portal Certificate Renewal: Action Required for Custom Application Users
Spain's Agencia Tributaria (AEAT) will renew the electronic certificate for its e-portal (sede.agenciatributaria.gob.es) on 16 November 2026, necessitating immediate action for organizations using custom-built applications to interact with the portal. Standard web browser users will not be affected.
Key takeaways
- The AEAT will renew the electronic certificate for its e-portal on 16 November 2026, affecting only custom application users.
- Organizations using ERP integrations or automated filing systems must update their trust stores to recognize the new Root CA, Intermediate CA 1, and Intermediate CA 2 certificates.
- Standard web browser users will not be impacted and do not need to take any action.
Context
The AEAT's upcoming certificate renewal is a procedural infrastructure update, separate from policy discussions around the Verifactu platform. The renewal will alter the certification chain—encompassing Root CA, Intermediate CA 1, and Intermediate CA 2—which validates the portal's identity. Organizations relying on automated systems to file taxes, manage compliance, or integrate with the AEAT via APIs must ensure their systems recognize the new trust chain. Failure to do so by 16 November 2026 could disrupt critical tax filing and compliance workflows.
The renewal is scheduled for early morning hours to minimize disruption to standard business operations. AEAT has proactively released the new public keys for the three certificate authorities, allowing affected organizations to prepare in advance. This update does not apply to users accessing the portal through standard web browsers, who will experience no disruption.
What's Changing
The renewal affects the certification chain that underpins the AEAT e-portal's security infrastructure. Unlike previous renewals that might only update the leaf certificate, this renewal impacts the entire chain of trust. Custom application users—such as those operating ERP integrations, automated filing systems, or API-connected compliance tools—must download and install the new public keys for Root CA, Intermediate CA 1, and Intermediate CA 2 before 16 November. Standard web users will not need to take any action.
Organizations using custom applications must verify that their systems are configured to trust the new certificates. AEAT has provided these keys ahead of time, allowing sufficient lead time for testing and deployment. The early morning renewal timing is intended to minimize disruption during business hours.
Implications for Custom Application Users
Custom application users—particularly those with ERP integrations, automated filing systems, or API-based compliance tools—face immediate action requirements. These organizations must ensure their trust stores are updated to recognize the new Root CA, Intermediate CA 1, and Intermediate CA 2 certificates. Failing to do so could result in broken integrations, disrupting critical tax filing and compliance processes.
The renewal carries no direct policy implications but represents a significant operational risk for unprepared organizations. Technical and compliance teams should prioritize this update to avoid potential disruptions on or after 16 November.
Outlook and What to Watch
The renewal is a procedural infrastructure update, distinct from broader policy discussions like those around the Verifactu platform. Organizations should monitor AEAT communications for any additional guidance on the renewal process and ensure their systems are tested against the new certificates.
Key milestones include the availability of new public keys for Root CA, Intermediate CA 1, and Intermediate CA 2, which organizations should download and install as soon as possible. The renewal itself is scheduled for early morning on 16 November, minimizing disruption to standard business operations.
Frequently asked questions
- What is the deadline for updating trust stores?
- The deadline to update trust stores and install the new public keys is 16 November 2026.
- Who is affected by this certificate renewal?
- Only organizations using custom-built applications to interact with the AEAT e-portal are affected. Standard web browser users will not be impacted.
- Where can I download the new public keys?
- The new public keys for Root CA, Intermediate CA 1, and Intermediate CA 2 are available for download on the AEAT's official e-portal.
- Will this renewal disrupt standard business operations?
- The renewal is scheduled for early morning hours to minimize disruption during standard business hours.
- What should organizations do to prepare?
- Organizations should download and install the new public keys for Root CA, Intermediate CA 1, and Intermediate CA 2 as soon as possible to ensure their systems recognize the new certification chain.