A Qualified Electronic Signature (hereinafter referred to as a “QES”) is information attached to or otherwise logically associated with an electronic document which, subject to the conditions laid down in Act No. 272/2016 Coll. on Trust ServicesOpens in a new window, makes it possible to reliably and unambiguously identify the natural person who created it.
A QES enables legal acts to be carried out electronically where written form is required in the paper-based environment (Section 40(4) of Act No. 40/1964 Coll., the Civil CodeOpens in a new window). In such cases, a QES replaces the handwritten signature in written form. For this reason, its use is essential for certain transactions conducted through electronic communication with public authorities and the commercial sector.
A QES applied to an electronic document ensures:
\* A qualified certificate for an electronic signature must contain the person's first and last name or a pseudonym. If a pseudonym is used, this must be clearly indicated. The certificate may also contain optional information; in Slovakia, the person's birth identification number or identity card number is commonly included. A qualified mandate certificate for an electronic signature must also contain information about the principal and the mandate.
For more information about the validity of an electronic signature certificate, an electronic seal certificate or a timestamp, please refer to the related article, “Frequently Asked Questions and Answers”.
Citizens can use KEP when communicating with public authorities through the central public administration portalOpens in a new window by submitting a universal application to various entities (notaries, bailiffs, state administration organizations, cadastral offices, etc.), and when communicating, for example, with the Commercial Register of the Slovak Republic and JKM—Trade License Registry Services. Furthermore, the KEP can be used when communicating, for example, with the Financial Administration of the Slovak Republic, with courts, etc.
To create a QES, a citizen must have the following:
No, a QES itself cannot be obtained as a stored item. A QES can only be created using the appropriate signing tools, namely a private key and a signing application. This is similar to a handwritten signature, which requires a medium (e.g. paper) and a tool to create it (e.g. a pen). What can be obtained is a qualified certificate for an electronic signature, issued for the public key corresponding to the private key stored on the electronic identity card.
A qualified certificate for an electronic signature is an electronic document through which the certificate issuer confirms that the public key specified in the certificate belongs to the person to whom the certificate was issued (the certificate holder).
Qualified certificates may only be issued by a qualified trust service provider.
A private key is secret information used to create an electronic signature or a qualified electronic signature on an electronic document. A public key is information made available to the person verifying the signature. It is used to verify the validity of an electronic signature or qualified electronic signature created using the private key corresponding to that public key. The private and public keys are cryptographically linked and therefore form a key pair. These concepts are associated with asymmetric cryptography, which forms the basis of electronic signature creation.
An electronic identity card is a secure device for storing cryptographic keys (private and public) and a qualified certificate for an electronic signature used to create a QES. The keys and certificate are stored in the memory of the electronic identity card's chip. The private key cannot be exported in any way, meaning that it exists only in a single instance on the specific electronic identity card.
A citizen may apply for the issuance of a qualified certificate for an electronic signature at a District Directorate of the Police Force when collecting their eID card, or at any time thereafter.
A foreign national may apply for the issuance of a qualified certificate for an electronic signature at a Foreign Police Department of the Police Force when collecting their eDoPP (electronic residence permit), or at any time thereafter.
A qualified certificate for an electronic signature can also be issued remotely, from the comfort of one's home, for an identity card or residence permit with an electronic chip, using the eID Application. The application, together with its user manual, is available on the website of the Ministry of the Interior of the Slovak Republic Opens in a new windowor in the Software applications for download Opens in a new windowsection.
The issuance of a qualified certificate for an electronic signature on an identity card with an electronic chip or a foreign national's residence permit at a client centre, or remotely via the eID Application, is free of charge. However, the issuance of qualified certificates for other devices (e.g. other smart cards or tokens) by various commercial trust service providers is generally subject to a fee.
The validity of a qualified certificate may be terminated (revoked) before its expiry date by revoking the certificate (see the question: How can a certificate on an electronic identity card be revoked?).
Qualified certificates for electronic signatures issued by SVK eID ACA for Slovak identity documents are generally issued with a validity period of 5 years and 1 month (61 months). If the certification of the chips in these documents is valid for a shorter period, the certificates are issued for a correspondingly shorter period.
For example, from 27 May 2021, certificates were issued with a validity period ending on 30 December 2022, because the certification of the electronic chips in the original identity cards and residence permits also expired on that date. After the certification expired, all qualified certificates with a later expiry date were revoked in bulk.
Similarly, from 21 June 2021, identity cards equipped with new electronic chips were temporarily issued. New qualified certificates for electronic signatures, issued by SVK eID ACA2, were uploaded to these cards with an expiry date of 17 June 2025, which was also the date on which the certification of the electronic chips in these identity cards expired.
Important notice:
The expiry or revocation of a qualified certificate does not affect the validity of the login function used to access the central government portal or specialised portals. Nor does it affect the validity of non-qualified PCA and SCA certificates. However, these certificates cannot be used to sign electronic submissions and their attachments. They can only be used to create an advanced electronic signature, which does not have legal force in the Slovak Republic but is a format recognised under the eIDAS Regulation that may be accepted by other EU Member States where this level of security is permitted.
The following information applies to identity cards and residence permits equipped with electronic chips.
When an eID card is inserted into a smart card reader, the eID Application (versions 3.6 and 3.6 Update 1) checks the following:
When older eID cards (with CardOS 5.0) are inserted into the reader, the application requests the user's Personal Security Code (BOK) to retrieve the certificates. For newer eID cards (with CardOS 5.4), entering the BOK is not required.
If no certificates have been issued for the eID card, the application will not automatically offer the option to issue them. Certificates can be uploaded manually by selecting “Issue Certificates” from the application's context menu.
The eID Application (versions 3.4 and earlier), after an eID card is inserted (older eID cards with CardOS 5.0 only) and the Personal Security Code (BOK) is entered, checks the following:
Note:
Since 26 June 2021, it has no longer been possible to issue new certificates for eID cards with CardOS 5.0. Certificates already issued on cards with CardOS 5.0 remain valid until 31 December 2022 or until their individual expiry date, whichever occurs first.
Warning:
The eID Application does not check whether a certificate on an eID card has been revoked. This can be verified using the Ministry of the Interior's SR service.Opens in a new window
Yes. A citizen may apply for a new qualified certificate through an online e-Government service no earlier than 30 days before the first qualified certificate expires. Alternatively, once the qualified certificate has expired, the citizen may apply in person at any document office of the Police Force.
An additional qualified certificate for an electronic signature can also be issued remotely, from the comfort of one's home, for an identity card or residence permit equipped with an electronic chip, using the eID Application.
A citizen can use a qualified electronic signature (QES) to sign electronic documents when communicating with public authorities and commercial entities. This can be done either directly on designated websites accessible via the Internet or offline using software installed on the citizen's computer. Consequently, there is no need to visit the relevant institution in person.
To create a qualified electronic signature (QES) using an electronic identity card, the following requirements must be met:
When creating a qualified electronic signature while communicating online with public authority services, the citizen's computer must also be equipped with:
One of the security measures used when creating a Qualified Electronic Signature (QES) is so-called two-factor authentication. This means that a citizen creating a QES must possess something (an electronic identity card containing a private key) and know something (the QES PIN). A QES cannot be created without these two factors.
Another security measure for creating a QES using an electronic identity card is the restriction on the number of times an incorrect QES PIN can be entered. After three (3) incorrect PIN entries, the use of the private key to create a QES is blocked. Access can only be restored using the QES PUK.
The QES PIN consists of six (6) digits, while the QES PUK consists of eight (8) digits.
The QES PIN is blocked after the third (3rd) incorrect entry. The number of incorrect entries is counted directly by the card, so it cannot be reset by removing the card from the reader or switching off the computer. The incorrect-entry counter can only be reset by entering the correct code.
If the QES PIN is blocked, it can only be unblocked using the QES PUK. The QES PUK itself is blocked after ten (10) incorrect entries.
Citizens choose their QES PIN and QES PUK when a qualified certificate for an electronic signature is issued for the first time on their electronic identity card.
After inserting the electronic identity card into the smart card reader, the BOK (Personal Security Code) must be entered. Subsequently, when creating a QES, the QES PIN must be entered.
When the QES PIN is blocked, the private key stored on the electronic identity card and intended for creating a QES becomes inaccessible, and it is no longer possible to create a QES.
The function for creating a QES on an electronic identity card can become blocked if either the BOK or the QES PIN is blocked.
If the BOK is blocked, the citizen must visit a District Directorate of the Police Force, where the BOK can be unblocked.
If you have an identity document issued after 21 June 2021, you can unblock the BOK using the PUK in the settings of the eID Application, under the PIN Management section.
If the QES PIN is blocked, the citizen can unblock it using the QES PUK, provided that they selected one when their electronic identity card was issued.
If the citizen did not select a QES PUK and the QES PIN becomes blocked, the QES functionality can only be restored at a District Directorate of the Police Force by issuing a new qualified certificate for an electronic signature. The same procedure applies if the QES PUK is blocked.
When the QES PUK is blocked, the part of the card containing the cryptographic keys and the qualified certificate for the electronic signature is irreversibly blocked.
Once the QES PUK is blocked, the cryptographic keys stored in that part of the card can no longer be used. The only solution is to restore the entire affected area of the card, which results in the loss of the keys used up to that point.
The KEP PIN and KEP PUK can be changed using the PIN Management function in the eID Application.
These values can be changed at any time, without any restrictions.
Certificate revocation is used when a citizen suspects that someone other than themselves has access to their electronic identity card and could create a qualified electronic signature (QES) on their behalf, for example, if the eID card is lost or stolen.
Certificate revocation is also used by trust service providers issuing qualified certificates, for example, when a certificate for a qualified device used to store a private key expires, when the security of the algorithms in use is weakened, or when the provider obtains information about changes to the data contained in the certificate.
A citizen may request the revocation of any certificate on their electronic identity card by visiting any District Directorate of the Police Force in person or by using the electronic service.Opens in a new window
Qualified certificates may also be revoked by the certificate issuer itself (the trust service provider) without a request from the certificate holder. This may occur, for example, if the validity period of an issued qualified certificate exceeds the validity period of the certification of the device (e.g. a smart card) for which it was issued, or if a known reduction in its security results from the cryptographic algorithms used.
If a citizen decides to obtain a qualified certificate for an electronic signature on their electronic identity card at a later date, the certificate can be issued at a District Directorate of the Police Force or through the eID Application.
No. To view the certificates, the citizen must enter their personal security code (BOK).
Three different types of certificates may be issued to the holder of an electronic identity card:
Users are advised not to use non-qualified certificates of the PCA and SCA types when communicating with public authorities, as these certificates cannot be used to create a qualified electronic signature. A PCA certificate can only be used to create an advanced electronic signature, which, under the e-Government Act, Opens in a new windowis not accepted as valid authentication.
The main difference lies in the purposes for which the certificates may be used under the applicable legislation. Only a qualified certificate can be used to create a qualified electronic signature (QES), which is the electronic equivalent of a handwritten signature. When accompanied by a qualified electronic time stamp, it is equivalent to a notarised handwritten signature.
A non-qualified personal certificate cannot be used to create valid authentication under the e-Government Act and is generally not used for communication with public authorities.
If an identity card is lost or stolen, a new card must be issued for a fee. Certificates are issued free of charge on newly issued cards.
If you need to add a signature or seal to a document that cannot be processed for technical reasons by the qualified electronic signature application or the Central Electronic Filing Office — for example, if the “Sign” option does not appear in the message creation interface, or an error message instructs you to use applications provided by other vendors — you can use services such as QSignOpens in a new window, Disig Desktop SignerOpens in a new window, Podpisuj.skOpens in a new window, QES PortalOpens in a new window, the QES ApplicationOpens in a new window, or D.Bulk Signer – Standard.Opens in a new window
On these portals, you first upload the document, then sign or seal it, and finally download it and upload it to the required destination.
Please note that public authorities are required to accept only document formats prescribed by applicable legislation.Opens in a new window
Under Regulation (EU) No 910/2014 of the European Parliament and of the Council on electronic identification and trust services for electronic transactions in the internal market (eIDAS), qualified electronic signatures are accepted in the following formats: ASiC, XAdES, CAdES and PAdES.
If you used Adobe Acrobat Reader to sign a document and your qualified electronic signature is evaluated as invalid, this may be because you left the default PKCS#7 signature format in the settings instead of changing it to the accepted CAdES format.
You can change the signature format in Adobe Acrobat Reader as follows:
Important notice: The National Agency for Network and Electronic Services (NASES) is not responsible for the proper functioning of signing processes performed using third-party applications, such as Adobe Acrobat Reader, and does not provide support for these applications.
The following sections outline the main reasons why the Central Government Portal (ÚPVS) generates the ASiC format, together with a comparison of its features and those of the PDF format containing a PAdES signature.
Signatures in ASiC generated on the Central Government Portal
PAdES format
The results of an informative signature or seal validation performed through the Central Government Portal may identify the following legal types of signatures and seals.
Qualified electronic signature
This is a qualified electronic signature (QES) that, under Regulation (EU) No 910/2014Opens in a new window of the European Parliament and of the Council (eIDAS), has the same legal effect as a handwritten signature.
Under Act No. 305/2013 Coll.Opens in a new window on e-Government, a qualified electronic signature is one of the methods that may be used to authorise electronic submissions.
If the qualified electronic signature includes a qualified electronic time stamp, it has the legal effect of a signature whose authenticity has been officially certified.
Qualified electronic seal
This is a qualified electronic seal which, under Act No. 305/2013 Coll.Opens in a new window on e-Government, is one of the methods that may be used to authorise electronic submissions and, when accompanied by a qualified electronic time stamp, electronic official documents.
A qualified electronic signature or seal displayed with a Slovak flag in the results of signature validation does not have to be accepted by public authorities, as it was created in a Slovak format used under legislation that was in force until 30 June 2016.Opens in a new window This format is not fully compliant with Commission Implementing Decision (EU) 2015/1506.Opens in a new window
Recognised method of authorisation under the MIRRI SR Decree on Recognised Methods of Authorisation
Under Section 23(10) of Act No. 305/2013 Coll.Opens in a new window, public authorities may decide whether to accept this method of authorisation.
The list of services for which this recognised method of authorisation is accepted is published in the relevant article.Opens in a new window
Since the decree entered into force on 1 January 2023, advanced electronic signatures based on qualified certificates have been validated by the Central Government Portal as a recognised method of authorisation. This is a transitional solution introduced because the certification of electronic identity cards with a chip and residence documents issued up to 20 June 2021 has expired.
Qualified mandate electronic signature
This is a qualified electronic signature created using a mandate certificate.
Under Act No. 305/2013 Coll.Opens in a new window, such a signature, accompanied by a qualified electronic time stamp, is required when authorising electronic official documents if specific legislation requires authorisation by a particular person or by a person acting in a specific capacity.
Advanced electronic signature based on a qualified certificate
This type of signature cannot be used to authorise electronic official documents.
A public authority may decide to accept such a signature on an electronic submission or its attachments if the applicable legislation permits them to be submitted without authorisation.
A public authority is required to accept this type of signature if specific legislation requires authorisation by an advanced electronic signature (or seal) based on a qualified certificate, or by an advanced electronic signature.
This is a signature created using a qualified certificate that is not stored on a qualified device for creating qualified electronic signatures. Consequently, it does not contain the QSCD or SSCD designation. Because the private key associated with such a qualified certificate can be transferred without the protection of a qualified device, this type of signature provides a lower level of security.
Advanced electronic seal based on a qualified certificate
This type of seal cannot be used to authorise electronic official documents.
A public authority may decide to accept such a seal on an electronic submission or its attachments if the applicable legislation permits them to be submitted without authorisation.
A public authority is required to accept this type of seal if specific legislation requires authorisation by an advanced electronic seal based on a qualified certificate, or by an advanced electronic seal.
This is a seal created using a qualified certificate that is not stored on a qualified device for creating qualified electronic seals. Consequently, it does not contain the QSCD or SSCD designation.
It should be noted, however, that before Act No. 272/2016 CollOpens in a new window. on Trust Services entered into force on 18 October 2016, some trust service providers issued qualified seal certificates without the QSCD or SSCD designation even when the certificates were stored on a qualified device.
This mainly concerns certificates issued by CA Disig and CA Disig QCA3, whose validity expired progressively during 2019 and 2020. Consequently, the validation results for such seals will identify them only as advanced electronic seals based on a qualified certificate.
Advanced electronic signature
This is a signature created without using a qualified certificate. It cannot be used to authorise electronic official documents, electronic submissions, or attachments to such submissions.
Services for validating this type of signature are generally not widely available. As a result, publicly accessible validation services usually report it as invalid.
A public authority may decide to accept such a signature on an electronic submission or its attachments if specific legislation permits the submission or attachments to be sent without authorisation.
A public authority is required to accept such a signature if specific legislation requires authorisation by an advanced electronic signature.
Advanced electronic seal
This is a seal created without using a qualified certificate. It cannot be used to authorise electronic official documents, electronic submissions, or attachments to such submissions.
Services for validating this type of seal are generally not widely available. As a result, publicly accessible validation services usually report it as invalid.
A public authority may decide to accept such a seal on an electronic submission or its attachments if specific legislation permits the submission or attachments to be sent without authorisation.
A public authority is required to accept such a seal if specific legislation requires authorisation by an advanced electronic seal.
Currently, the D.Suite system is used to create qualified electronic signatures in the user interface of the Central Government Portal on Apple macOS and GNU/Linux operating systems.
This system uses Azul OpenJDK Java provided by Zulu. Therefore, the required Java components must be installed.
The Java implementation used is fully compatible with the Java SE standard and will be supported until 2031. The basic version intended for production use is available free of charge.
The signature validation service of the Central Electronic Mailroom does not support the validation of nested signature containers.
Therefore, if you need information about all nested signatures, we recommend checking whether any of the signature containers, particularly those in ASiC format, contain nested signatures.
Nested signatures may occur inside a signature container, particularly when the ASiC file contains:
Documents contained in signature containers can be saved, for example, through the message composer by opening any service and attaching the container as an attachment. Alternatively, the D.Viewer application can be used.
If an attachment contains nested containers or nested signed files, you must download the individual nested signed files after attaching the file, using the “...” (three dots) button.
Further information is available in the MDU User Guide for Public Authorities,Opens in a new window on pages 17 and 18.
When you use the D.Signer/XAdES application to sign a PDF file that has already been signed by another person, the application may return the error “Invalid pdf version”. Alternatively, the message composer may warn you that an unsupported PDF version is being used.
The reason is that you are signing an already signed PDF file whose version is higher than 1.4, whereas D.Signer/XAdES supports PDF files up to version 1.4.
Systems generally do not allow an already signed PDF file to be converted to a lower version because this would damage or invalidate the existing signature on the file.
If the system responsible for signing sends a PDF file to D.Signer/XAdES without converting it to version 1.4 or PDF/A-1, signing will fail. For example, the following error may occur:
filename.pdf. Description: PdfVisualizer.parsePdf 0.1: Invalid pdf version - %PDF-1.7
To add another signature to an already signed PDF, the following solutions are available:
a) The original signatory can create the document again in PDF version 1.4. It can then be signed using an application that supports PAdES or ASiC-XAdES.
b) Alternatively, the second signatory can sign the document using an application other than D.Signer. Examples include:
