ECC signature certificates on identity cards issued before 13 March 2023 will be centrally revoked – The revocation does not affect the use of identity cards

The Digital and Population Data Services Agency will revoke signature certificates using ECC technology from identity cards issued between 11 January 2021 and 12 March 2023. The certificates will be revoked in a mass revocation during May. If necessary, the issuance date of the identity card can be checked on the surface of the card.

Identity cards can continue to be used normally

The revocation does not require any actions from the card holder. The identity card can continue to be used safely both for electronic identification and for creating electronic signatures.

The identity card contains two signature certificates: a signature certificate using ECC technology and a signature certificate using RSA technology. Both are equally valid. In addition to the signature certificate, the identity card includes a separate authentication certificate.

For identity cards whose ECC signature certificate is revoked, the authentication certificate and the RSA-based signature certificate will remain valid.

Why is the ECC signature certificate being revoked?

The revocation is due to a low-level technical vulnerability detected in the renewal of certification of identity cards that affects the ECC signature certificate. Exploiting the identified vulnerability is extremely difficult and therefore does not pose a significant risk to the card holder. The mass revocation is carried out to comply with certification requirements related to certificates.