Guides

Brazilian electronic certification: the certificate's life cycle, from the Root CA to expiry

An ICP-Brasil certificate is born, works, can be renewed or revoked and, one day, expires. Understanding Brazilian electronic certification as a cycle — rather than a file you download — spares people abroad the classic shocks: discovering it expired the day before a deadline, assuming an old signature lost its value, or fearing that revocation erases contracts. This guide walks through each stage and ends with what you can do today: issue or renew by video call, without returning to Brazil.

  • ITI → Certisign CA → RA chain explained
  • Remote renewal before expiry
  • Revocation at any time, by the holder
  • Support in Portuguese and English

⚠️ Important notice

This is not a government website. Certificado Digital Global is a Registration Authority accredited to the Certisign network, a brand of Kindness in Business Consulting Ltd (UK Company No. 10386293), serving clients from London. Issuance depends on identity validation, documentation and ICP-Brasil rules. Do not send CPF, passport or sensitive documents via WhatsApp or the initial form.

O que é

An ICP-Brasil certificate is born, works, can be renewed or revoked and, one day, expires. Understanding Brazilian electronic certification as a cycle — rather than a file you download — spares people abroad the class…

Para quem

ITI → Certisign CA → RA chain explained · Remote renewal before expiry

Como resolve

Revocation at any time, by the holder · Support in Portuguese and English

Limite

Não é site do governo. Emissão sujeita a validação de identidade, documentação e normas da ICP-Brasil.

Who's who in the chain

Brazilian electronic certification is a hierarchy of trust. At the top sits ITI, which operates the Root CA; below it, the accredited certificate authorities, such as Certisign CA, which actually issue the certificates; at the edge, the registration authorities, which confirm the identity of whoever applies. Each link vouches for the next, and that chain is what makes a PDF signed in Lisbon or Seoul acceptable at any Brazilian notary.

ITI (Root CA)

The federal body that sets the rules and signs the certificates of the first-level CAs.

Certisign CA

Issues your certificate and maintains the CRL and the OCSP service that report whether it remains valid.

RA (us)

Receives the documents, runs the video call, checks identity and forwards the issuance. Never has access to your private key.

Holder (you)

Keeps the private key, signs, renews and, if necessary, revokes.

The six stages, one by one

What happens to what you've already signed

This is the question we hear most from people far away: “if the certificate has expired, is the contract I signed last year still valid?”. It is. A signature is assessed against the moment it was made — if the certificate was valid and unrevoked at that instant, the signature stays valid forever. Later expiry or revocation prevents new signatures; it doesn't undo old ones. When the date needs to be provable without relying on a computer's clock, an ICP-Brasil timestamp, issued by a timestamping authority accredited by ITI, supplies that proof.

A full cycle seen from outside Brazil

Real case

Illustrative scenario. A Brazilian marine biologist in Cape Town issued an A3 e-CPF on a token almost three years ago, to sign survey reports for a project with a university in Pará. Now she gets the notice that the token is about to expire and panics: would the delivered reports lose their validity? The project coordinator checks one of the PDFs on ITI's validator and sees the signature confirmed, with its original time. Reassured, she books her renewal by video call at a time that suits South Africa, opts this time for an A1 — more practical for someone who sets off on expeditions — and, before the token expires, is already signing with the new certificate. The old one lapses on schedule, with no effect whatsoever on the earlier work. — A typical planned renewal for someone signing technical documents from abroad

Before you decide

“I lost my token; can I recover the password?”

There is no recovery. The private key was never held by the RA or the CA. The route is revoking the old certificate and issuing a new one by video.

“I let it expire months ago”

No validity problem for anything already signed. To sign again, a fresh issuance with identity validation is all it takes.

“I live in a time zone far from London”

The validation session is booked at a time agreed with you, including slots that suit Africa, Asia and Oceania.

“Wouldn't it be better to renew on a trip to Brazil?”

Renewal by video costs the same and needs no in-person appointment. The trip is only justified for other reasons.

Transparent pricing

From €200

Issuance and renewal are the same in nature — identity validation and a fresh issuance — and share the same starting price. An A3 with longer validity spreads the cost per year; an A1 makes life easier for those who travel.

Initial reference price; model and validity period are settled with you on WhatsApp before issuance.

Issue or renew from abroad

Frequently asked questions

Related guides

Which stage is your certificate at?

Send “I want to start” with your country and say whether it's a first issuance, a renewal or a replacement. We point you to the next step and the validation slots.

Send “I want to start”

Solicite orientação

Formulário curto para lead inicial. Não solicitamos CPF, data de nascimento, passaporte, upload de documentos ou dados financeiros nesta etapa.