Finding a CER file does not mean you have everything needed to renew your e.firma. If you have lost the KEY file or its password, identify what is missing first: downloading another certificate copy does not replace the private key. SAT lets you download the CER, but does not store your KEY or know its password, according to its certificate download service.
This decision applies to adult individual taxpayers, known in Mexico as personas físicas. Renewal through SAT ID may apply when their e.firma expired no more than one year ago, but they must retain the necessary files and password. If those are missing, SAT identifies an appointment as the alternative in its renewal procedure.
Original Fintax Instagram publication about e.firma expiry and renewal.
What you can download and what you must locate
The CER is the downloadable public certificate. The KEY is the private key and requires its own password to be used. Do not confuse that password with the SAT portal login credential called Contraseña: being able to access the portal does not establish that you can use the key. The official download retrieves the CER, not the KEY or its password; SAT describes that scope in its download service.
Choose a route by certificate status and available files
Standard validity is four years, but use your certificate's dates and confirm its status rather than relying on when you remember visiting SAT. See the official procedure. The table summarizes the routes in Annex 2 of the 2026 RMF, pages 48-50 and recommended checks for choosing between them.
| Situation | Route or next decision | What to check first |
|---|---|---|
| Certificate still valid | Renewal using a .ren file generated in Certifica and submitted through CertiSAT | Access to the necessary files and password |
| Expired up to one year ago | SAT ID identity authorization, followed by Certifica and CertiSAT | Access to the previous e.firma and its password |
| Expired more than one year ago | Check the appointment route; do not use the shortened SAT ID route | Exact expiry date and applicable procedure |
| KEY or its password missing | Search your own backup; if still missing, arrange an appointment | Downloading the CER does not recover the key |
| Revoked or potentially compromised | Ask SAT about the specific route before attempting renewal | Do not treat this as ordinary expiry |
Check your files before starting SAT ID
- Record the certificate's expiry date. Confirm its status through official channels before choosing a route.
- Look for the CER and KEY on your computer, USB drives and secure personal backups. A folder named e.firma is not enough: check which files it contains.
- On your own computer, check that the CER and KEY belong together and that you can use the private-key password. Do not send those items to someone else for testing.
- If you have the necessary items and the certificate expired up to one year ago, review the SAT ID route. If the KEY or its password remains missing after your search, prepare for an appointment under the applicable procedure.
For certificates that expired within that period, SAT ID provides identity authorization; that authorization is not the renewed certificate. You then generate a .req file in Certifica and complete renewal through CertiSAT using the previous e.firma. Without its KEY or password, this route is unavailable. The sequence is set out in Annex 2, pages 48-50.
Example: expired eight months ago, with only the CER
Assume Laura is an adult individual taxpayer whose certificate expired eight months ago. She has only the CER and no indication of revocation or compromise. Although she falls within the period of up to one year, she lacks the KEY: downloading the CER again leaves the same problem unresolved. Obtaining SAT ID authorization would not replace that file either.
Laura checks a stored USB drive and her personal backup. If she finds the KEY, she verifies that it matches the CER and that she has its password before continuing. If she cannot find it, or cannot use it because the password is missing, she follows the appointment alternative identified by SAT. The eight-month interval is not the sole deciding factor: she must also be able to use the previous e.firma.
Controls to prevent another loss
As recommended controls, keep a protected backup of the CER and KEY, store the password securely and separately, and record which certificate belongs to each file pair. Check that you can access the backup before you need it. Use official domains and avoid sharing the private key. These are organizational and security measures, not additional procedural requirements.
Frequently asked questions
Can SAT give me my KEY back?
You cannot recover it through the certificate download. SAT states that it does not store the KEY or know its password; its download service provides the CER.
Does SAT ID authorization finish the renewal?
No. It is one stage of the applicable route. Certifica and CertiSAT still follow, using the previous e.firma, under Annex 2, pages 48-50.
What should I prepare for an appointment?
Check the documents and conditions in the current procedure that applies to your situation through the official renewal page. Identify whether your issue is expiry, missing files or a missing password so you do not prepare for a route you cannot complete.
