Changes to Suomi.fi e-Identification certificate practices

The lifetime of TLS certificates will be reduced gradually in the next few years. In March 2026, it will be reduced to 200 days, and in a few years, to 47 days. Shortening the lifetime of TLS certificates will bring changes to the Suomi.fi e-Identification certificate guidelines. 

Changes to Suomi.fi e-Identification certificate practices

Changes to Suomi.fi e-Identification certificate practices apply to the SAML certificate type and the validity of the certificates. 

The SAML certificate type in the e-service metadata file must be a system signature certificate instead of a server certificate. The system signature certificates are issued by the Digital and Population Data Services Agency. For additional information on ordering Digital and Population Data Services Agency certificates, please visit https://dvv.fi/en/how-to-order-a-service-certificateOpens in a new window.. Continuing to use TLS certificates will increase the amount of maintenance work in e-services due to the shortened lifetime of the certificates. For this reason, we recommend adopting a system signature certificate issued by the Digital and Population Data Services Agency that is valid for two years. 

You can find the Suomi.fi e-Identification certificate guidelines at https://kehittajille.suomi.fi/services/e-identification/how-to-implement-the-technical-setup-of-the-identification-service/metadata/creating-metadata-for-the-e-service. 

Impact on the test environment

You can use self-signed certificates in the test environment. The validity of certificates in the test environment must not exceed 2 years. 

Schedule

We had announced the changes to the certificate practice in Suomi.fi e-Identification earlier. You can read the previous release at https://kehittajille.suomi.fi/topical/changes-to-suomi-fi-e-identification-certificate-practices-action-required-from-e-services.

We are giving the e-services one additional year to verify the validity of the SAML certificates. Validity checks for expired certificates will begin on 1 January 2028. This additional time allows e-services to deploy the OIDC-interface before the validity checks for TLS certificates begin. If an e-service is using outdated environments that need to be deleted, they must request the deletion of these environments from tunnistus-kayttoonotot@dvv.fi. E-service operators cannot delete these environments on their own.

Actions required from e-services

Please check the validity of your service’s SAML certificate. If necessary, contact your system provider for more information. 

If the certificate has expired, follow the instructions to update the new certificate. If the certificate is valid, make note of the certificate instructions for the next certificate update.

Additional information

Read more about the reduction of TLS certificate lifetimes: https://www.digicert.com/blog/tls-certificate-lifetimes-will-officially-reduce-to-47-daysOpens in a new window..