If you see messages like “Certificate not valid”, “Error loading .key file”, or the SAT portal page simply freezes when trying to renew your e.firma (formerly FIEL), you are not alone. This is one of the most common errors among Mexican taxpayers and can have several causes: an expired certificate, an incompatible browser, an outdated Java version, or mismatched .key/.cer files. This guide will help you identify the exact cause and resolve it step by step.

The Error

The most common error messages when trying to renew e.firma on the SAT portal are:

  • “The certificate is not valid or has expired” — appears when uploading the .cer file.
  • “Error reading private key” or “Incorrect password” — when loading the .key file.
  • “An error occurred while processing your request” — generic SAT portal message with no further detail.
  • The page goes blank or fails to load — browser compatibility or Java problem.
  • “Your certificate has been revoked” — the SAT cancelled the certificate for a specific reason.

The error can appear at any stage: when authenticating with e.firma, when uploading the request file (.req), or when trying to download the new certificate.

Root Cause

There are several possible causes. Identifying the correct one before attempting a fix is important:

  1. Expired certificate (over 4 years old): The e.firma is valid for 4 years for individuals and businesses. Once expired, the portal rejects the .cer file.
  2. Wrong private key password: The .key file is protected by a password you chose when you first obtained the e.firma. If you forgot it or type it incorrectly, the process fails.
  3. Mismatched .key and .cer files: If you have multiple versions of these files, you may be using a .key from an older renewal that no longer matches the active RFC.
  4. Incompatible or outdated browser: The SAT portal uses modern web technologies incompatible with older browsers (Internet Explorer, outdated Firefox).
  5. Outdated or blocked Java: Some SAT portal sections still require Java. If Java is outdated or blocked by the browser, the process stops.
  6. Revoked certificate: The SAT may revoke a certificate due to tax inconsistencies, duplicates, or at the taxpayer’s own request.
  7. Expired session or browser cache: A previous session not properly closed can cause errors when restarting the process.

Step-by-Step Solution

1. Verify certificate validity

Before attempting any fix, confirm whether your e.firma is still valid:

  1. Go to CertiSAT Web at sat.gob.mx.
  2. Enter your RFC (with homoclave).
  3. Check the “Expiration date” column for your active certificate.
  4. If the date passed less than one year ago, you can renew online.
  5. If it expired more than one year ago, you need an in-person appointment.

2. Clear cache and use the right browser

  1. Open Google Chrome or Microsoft Edge (latest versions).
  2. Press Ctrl + Shift + Delete to clear cache, cookies, and browsing data from the last 24 hours.
  3. Close and reopen the browser before accessing the SAT portal.
  4. Disable extensions such as ad blockers or VPNs that may interfere.

3. Download and use the Certifica application

The SAT replaced the Java-based browser process with the Certifica desktop application:

  1. Go to sat.gob.mx and search for “Certifica” in the portal search bar.
  2. Download the version for your operating system (Windows, macOS, or Linux).
  3. Install and open the application.
  4. Select the option “e.firma renewal”.
  5. Load your current .cer file (the one for the e.firma you want to renew).
  6. Enter the password for your private key (.key).
  7. If the system accepts the file, generate the request file (.req) and save it on your computer.

4. Upload the request file to the SAT portal

  1. Log in to sat.gob.mx with your RFC and password or with e.firma.
  2. Go to the “e.firma renewal” procedure.
  3. Upload the .req file generated with Certifica.
  4. Follow the on-screen instructions and confirm the submission.

5. Download the new certificate

  1. Access CertiSAT Web (sat.gob.mx/tramites/certifica).
  2. Enter your RFC and look for the new certificate in the list.
  3. Download the new .cer file.
  4. Save the file pair (.key + new .cer) in a secure location, preferably a dedicated USB drive.

Alternative Solution

If you cannot complete the process online because the certificate has expired or you have persistent technical issues, request an in-person appointment at the SAT:

  1. Go to sat.gob.mx and search for “Citas” (appointments).
  2. Select the procedure “e.firma (individuals)” or “e.firma (companies)”.
  3. Choose the nearest office and an available time slot.
  4. Bring: valid official ID (INE/IFE or passport), CURP (individuals), articles of incorporation (companies), and if possible your USB with previous files.

At the office, a SAT advisor will generate a new .key and .cer pair directly onto your USB drive.

Prevention

To avoid this problem in the future:

  • Set a reminder 2 months before expiration. The e.firma lasts 4 years. Note the expiration date from day one.
  • Always keep the complete .key + .cer pair in at least two secure locations (USB and encrypted cloud backup).
  • Never share your .key file or private key password with anyone, not even your accountant.
  • Keep your browser updated. Chrome and Edge updates improve compatibility with the SAT portal.
  • Renew before expiration. The SAT portal allows renewal before the certificate expires. After expiration, the process is more cumbersome.
  • Check your e.firma periodically in CertiSAT Web to make sure it has not been revoked.

Summary

  • e.firma renewal on the SAT portal fails due to expired certificate, wrong password, mismatched files, incompatible browser, or outdated Java.
  • Always verify validity in CertiSAT Web before trying anything else.
  • Use the Certifica application (not the old Java-in-browser process).
  • Chrome or Edge (latest) are the recommended browsers; clear cache before attempting.
  • If the certificate expired more than one year ago, you must renew in person at a SAT office.
  • Always keep the .key + .cer pair in a secure place and remember the private key password.
  • Renew early: set a reminder 60 days before expiration.