AEAT e-Office certificate renewal: what to check

On 16 November 2026, early in the morning, Spain’s AEAT (Spanish Tax Agency) will renew the electronic certificate of its e-Office. According to the AEAT, regular users can continue accessing as usual with no expected impact. Only organisations using custom-built applications against AEAT services must ensure their systems trust the new certification chain.

Key takeaways

• AEAT will renew the e-Office certificate on 16/11/2026 in the morning.
• The AEAT says regular, browser-based access by users will not be affected.
• If you use custom integrations, verify trust in the new certification chain.
• AEAT provides public keys for the new root and intermediate authorities.
• Test your systems ahead of the change to avoid access or submission errors.

What the AEAT announced and why it matters

The Spanish Tax Agency (AEAT) has announced that on 16 November 2026, early in the morning, it will renew the electronic certificate of its e-Office. The AEAT itself clarifies that this renewal does not affect users who access the site in the usual way: they will be able to continue logging in and operating as normal. The relevant change is that the new credential is signed by a different certification chain, which can require adjustments for systems that connect programmatically.

If you log in with a browser to file tax returns, review cases or manage SII (Spain’s immediate VAT information system), you should not notice any difference. But if your company runs custom-built applications that consume AEAT services (for example, automations that submit data), you must confirm that those systems trust the new chain. The AEAT provides the public keys for the root authority and two intermediate authorities so they can be downloaded and configured if needed.

A short, proactive review helps you avoid surprises from the moment the change goes live: certificate trust failures or secure connections that cannot be established. Validate trust configuration on your servers, containers, or any environment that runs your integrations.

Who is affected and who is not? Typical SME and freelancer cases

Per the AEAT’s notice, normal user access to the e-Office remains unchanged. That includes the manual operations you carry out in a browser for your procedures. If you only work interactively, you should not need to take any special action.

You should act if your organisation uses any of the following:

• Custom developments that call AEAT services.
• In-house connectors that automate submissions or queries.
• Back-end services with stricter certificate policies or certificate/authority pinning.

In these scenarios, review the certification chain your application accepts. The AEAT indicates the chain that signs the new certificate for sede.agenciatributaria.gob.es changes and makes the corresponding public keys (root and intermediates) available for configuration if required.

If you use a standard management system without modifications and you work in the e-Office as usual, your operating system and browser typically handle trust lists. If you run more advanced automation, plan a technical review similar to any routine certificate rotation.

Avoiding errors from browsers and systems: basic checks

For those who access manually in a browser, the AEAT does not anticipate changes. Even so, it is wise to keep your environment current to minimise incidental issues:

• Modern, up-to-date browsers. Keep Chrome, Edge, Firefox or Safari at supported versions for your OS.
• Updated operating system. System updates typically include trusted certificate authority lists.
• No TLS interception issues. If you use SSL/TLS inspection on a firewall or corporate proxy, validate it will not interfere with the AEAT chain on the day of the change.
• System clock. Significant date/time drift can cause certificate validity errors.

If you see “site not secure” or “certificate not trusted” warnings after the change, first check for internal policies (antivirus, proxy, corporate certificates) that might be injecting certificates or blocking the new chain. Many issues are resolved by updating the system trust store or adjusting proxy rules.

If you have custom developments or in-house connectors: a technical guide

The AEAT specifies that only in the case of applications developed expressly to use AEAT services do you need to confirm your systems will accept the new certificate because the certification chain changes. Good practices for this transition:

• Inventory. Locate services, microservices or jobs that call AEAT domains (e.g., sede.agenciatributaria.gob.es).
• Trust review. Verify that your trust stores include the new chain (root and intermediates) published by the AEAT. If your runtime uses private stores (Java keystores, minimal containers, etc.), adjust trust accordingly.
• Avoid rigid pinning. If you pinned the old certificate or CA, update fingerprints or move to validating any valid chain to reduce future breakage.
• Environments. Mirror the change in development and pre-production to test secure handshakes before 16/11.
• Logging and alerts. Temporarily increase HTTP/TLS client logs during the change window to quickly diagnose verification errors.

The AEAT provides the public keys of the Root Certification Authority and two Intermediates for the new certificate of its domain. Download them from the official communication and keep them ready in case you need to import them into your trust stores.

Returns and SII from your management software: checks without guessing steps

The AEAT’s communication clarifies that regular use of the e-Office will not be affected. In practice: if you log in as usual to file returns or manage SII manually, you should not notice changes.

If your company uses custom integrations to automate data submissions to the AEAT, apply the trust-chain verification described above. Before 16/11, run a controlled test from the exact environment that performs the automated submissions and verify the TLS connection establishes cleanly.

If you work with a specialised partner around your management stack, coordinate the trust review as you would for any public credential rotation. In initiatives of process automation with Holded, it is prudent to validate external dependencies whenever public certificates rotate. Reinforce this with targeted sessions of personalised training in Holded to embed good operational practices across your team.

A lightweight plan before 16/11 and follow-up validations

Organise the transition with an efficient, low-friction plan:

• Week before: inventory integrations, review trust policies and detect any pinning. Prepare the public keys of the new chain published by the AEAT in case you need to import them.
• Day before: enable more verbose logs in clients that call the e-Office and agree a checkpoint with your team.
• Change day (morning): perform a smoke test: manual e-Office access and a minimal call from each critical integration; confirm no certificate errors occur.
• If something fails: first verify the accepted certification chain, the system clock and whether there is TLS inspection. Adjust trust by importing the root/intermediates provided by the AEAT if appropriate.
• Closure: document the final configuration to streamline future rotations.

If you collaborate with a Holded partner, you can include these validations in your steady-state operations. For broader change control around your stack, align this with your Holded Implementation Service and ongoing Holded Support and Maintenance.

Co-ordination and support: align your team and providers

Bring the right roles together:

• IT/Systems: owners of trust stores, proxies and updates.
• Development/DevOps: owners of HTTP clients, containers and pinning policies.
• Administration/Finance: functional validation of filings or SII after the smoke test.

Document which environments access the AEAT e-Office and how (manual vs automated). If you rely on external support, establish a direct channel for the change window. As part of continuous improvement, like the approach of a Holded agency partner, include a public certificates checklist among your operational runbooks.

Clear co-ordination shortens diagnosis time if a “certificate not trusted” alert appears. After the window, incorporate these practices into your procedures and training. ARTIC can help you embed them alongside your roadmap for digital operations and, where applicable, initiatives such as the Digital Kit for process management.

Frequently asked questions

When does the AEAT e-Office certificate change?

The Spanish Tax Agency (AEAT) has announced it will renew the electronic certificate of its e-Office on 16 November 2026, early in the morning.

Does this affect me if I access the e-Office in a browser as usual?

According to the AEAT, the renewal does not affect users who access in the usual way. You should be able to continue operating normally.

Who must review the certification chain?

Organisations that access AEAT services from custom-built applications must confirm their systems trust the new chain that signs the e-Office certificate.

What has the AEAT provided to ease the transition?

The AEAT has attached the public keys for the new certification chain of the domain sede.agenciatributaria.gob.es: the root certification authority and two intermediates, so they can be downloaded and configured if needed.

What are common symptoms of trust problems after the change?

Warnings about an untrusted certificate, inability to establish a secure connection, or TLS verification errors in your integrations. Check the trust store, system clock and any TLS inspection first.

Do I need to change anything in my management software if I don’t have custom code?

In principle, no. If your operation is the usual browser-based access and you do not use custom integrations against AEAT services, no changes are expected according to the official communication.

Want us to set this up in your Holded?

ARTIC is a Holded Solution Partner Gold. We help you implement Holded from scratch, automate invoices, collections and reminders, train your team and review and maintain your account every month. Tell us about your case and we will get it ready.

Sources

• : Renovación del certificado electrónico de la Sede Electrónica de la Agencia Tributaria

Informative article, up to date on the publication date with the official sources linked. Regulations change: check your specific case with your tax adviser.