Certificates in Identity Broker
Important: To start connecting to the Signicat Identity Broker, please start with the steps as described on this page. Without following these important steps you may experience delays, technical difficulties and/or even unnecessary expenses.
In order to set-up your SIB environment, Signicat requires a subdomain reserved through DNS for the use of the Signicat Identity Broker. This will enable you to make use of the different Identity Providers (IdPs).
To purchase a certificate, the first thing you will need is a Certificate Signing Request (CSR). This must be provided to you by Signicat.
In order for Signicat to generate a CSR for you, the following information is required:
The desired subdomain name you want to host the MySignicat environment (Signicat Identity Broker) on.
Company information (OIN or Chamber of Commerce number).
The Signicat Technical Support team will generate a CSR for you based on the information you have provided. Once you have received the CSR, you will now be able to purchase PKI Overheid certificates which are mandatory for DigiD and eHerkenning. The PKIO Certificate type you require is "Server CA 2020".
Please ensure that:
You do not independently purchase the certificates. Only use of the CSRs provided by Signicat.
You do not purchase any other kind of certificate than PKI Overheid (PKIO).
The certificate type is "Server CA 2020".
It is important to remember that self-signed certificates, Let's Encrypt certificates, and the likes, are not allowed. We require PKIO Certificates and the level of assurance they provide. There are three certificate providers that sell PKIO certificates:
​QuoVadis​
KPN
Digidentity
You will require a certificate for both the production and the pre-production environments. The number of certificates you must purchase in total, however, depends on the eID method being used. DigiD, which is more strict than most, requires certificates for:
the (sub)domain that is used to host the application on your end, and,
the subdomain that is used to host the SIB on our end.
Once you have received the certificates from the certificate provider, send the public part of the certificates (which will have the .pem or .cer file extension) to the Signicat Technical Support team.
Once your SIB environment has been set up, you will receive a notification from the Signicat Technical Support team and an invitation to start configuring your MySignicat account.
Tip: You can find more information on certificates in our Frequently Asked Questions section:
​
In case any of the steps mentioned above are unclear, please contact our Technical Support team via email [email protected] or by calling 