Electronic certificate and digital signature

The electronic certificate in a nutshell

A electronic certificate is a digital file issued by a certificate authority (CA) that binds a public key to the identity of its holder. It is the cornerstone of the digital signature — the technical implementation of the electronic signature.

Asymmetric cryptography

The digital signature relies on public/private key cryptography:

• Private key: kept secret by the signer, used to sign
• Public key: distributed within the certificate, used to verify

Anyone can use the public key to verify that a signature was indeed produced with the corresponding private key.

The role of the certificate

The electronic certificate:

• certifies that the public key genuinely belongs to a given person or organization
• is signed by the certificate authority (CA) that issued it
• has a limited period of validity (typically 1-3 years)
• can be revoked in the event of compromise

PKI: public key infrastructure

The set of hardware, software, procedures and policies used to issue, manage and revoke certificates forms a PKI (Public Key Infrastructure).

A modern PKI includes:

• root certificate authority (root CA)
• intermediate authorities
• revocation servers (CRL, OCSP)
• enrollment procedures

Qualified certificate vs. simple certificate

• Simple certificate: issued by any authority, for standard use
• Qualified certificate: issued by a QTSP (qualified trust service provider) listed on the EU trusted list. Mandatory for qualified signature (QES).

See the 3 levels of signature.

Digital signature vs. electronic signature

• Electronic signature: legal concept (eIDAS). Three levels.
• Digital signature: technical implementation via asymmetric cryptography.

An electronic signature may rely on a digital signature, but is not required to. A simple AES (OTP) does not use a personal certificate.

When a personal certificate is required

A personal certificate is only mandatory for:

• the QES (qualified signature)
• certain specific procedures (e-greffe, online tax filings)

For SES and AES, no personal certificate is needed — the platform handles the cryptography in the backend.

How to obtain a qualified certificate

1. Choose a QTSP (Docaposte Certigna, Universign/Oodrive, CertEurope…)
2. Undergo an identity verification (face-to-face or video KYC)
3. Receive the certificate on a device (YubiKey, smart card) or as software
4. Valid for 1-3 years, renewable

Cost: typically €50-200 per year.

How Certyneo helps you

Certyneo handles the cryptography in the backend for SES and AES signatures — you don't need any personal certificate. For QES cases, we interface with several European QTSPs to trigger the qualified signature without complexity.

Discover the Certyneo electronic signature solution

FAQ

Do I need a certificate to sign?

No for SES/AES. Yes for QES.

How much does a qualified certificate cost?

€50-200 per year with French QTSPs.

How do I renew it?

A streamlined procedure (identification already done), generally done online.

Can a certificate be revoked?

Yes, by the CA in the event of compromise. Check the CRL or OCSP.

Does ANSSI certify certificates?

No, it qualifies the QTSPs that issue qualified certificates.

Conclusion

The electronic certificate is the foundation of the qualified digital signature. For most uses (SES/AES), the platform handles everything in the backend — you have nothing to install.

Try Certyneo to send, sign and track your documents online simply, quickly and securely.