PKIoverheid G4 certificates now available at Digidentity
Digidentity now issues PKIoverheid G4 certificates for servers and SBR. Current G1 certificates expire on 12 November 2028 at 1 a.m. and can't be extended. Organisations that use PKIoverheid for government connections or accounting software need to switch before that date.
What is PKIoverheid G4?
PKIoverheid (PKIo) is the Public Key Infrastructure of the Dutch government, managed by Logius. G4 is the fourth generation and replaces G1. It uses the more modern RSASSA-PSS signing algorithm instead of RSASSA-PKCS1-v1_5, a longer key length, and one purpose per certificate with its own root certificate. This brings G4 in line with the latest ETSI standards, the eIDAS Regulation and the Dutch Digital Government Act (Wet digitale overheid).
Which G4 certificate replaces yours?
You use the PKIoverheid Private Server certificate (G1) for connections with systems such as Digipoort, Digikoppeling, DigiD and eHerkenning. It is replaced by the G4 Private TLS Generic Devices Organization Validated Server certificate.
You use the PKIoverheid Private SBR certificate (G1) in accounting software such as Exact, Visma, AFAS, Twinfield and SBR Nexus. It is replaced by the G4 Private Other Generic Legal Persons Organization Validated Authentication certificate.
Why G4 only works when both sides are ready
A G4 certificate only works when both sides of a connection support the new algorithm and the longer key length. If your own software isn't ready, the connection fails. If your system is ready but the party you connect to isn't, it fails too. Digipoort, for example, is expected to support G4 from the end of Q1 2027.
What you can do now
- Check your systems. Confirm they support RSASSA-PSS and the longer key length.
- Ask your software supplier. Find out if and when G4 support is available.
- Align with your chain partners. Ask the parties you connect with to switch in time.
- Plan the switch early. Aim to run on G4 by Q3 2028 at the latest, and don't wait until 11 November 2028.
How Digidentity helps you move to G4
Alongside our existing G1 certificates, Digidentity now issues the G4 successors. You apply fully online and remotely. Making your systems G4-ready is your responsability, together with your suppliers.
On 30 March 2026, Digidentity became the first Dutch qualified trust service provider (QTSP) listed on the EU Trusted List (EUTL) with PKIoverheid G4 certificates. The listing confirms that an independent conformity assessment body has assessed our qualified services. Qualified certificates under G4 therefore carry the highest legal status, recognised in every EU member state.
Act in time: Read more about how to prepare for G4.
Frequently asked questions
When do G1 certificates expire? On 12 November 2028 at 1 a.m. They can't be extended.
Can I switch to G4 now? Yes, if your own systems and those of your chain partners support G4. Check this first, or the connection won't work.
Does the application process change? Hardly. You order a new certificate from a recognised provider such as Digidentity, install it and carry on.