Guide

Your certificate in Parafa, step by step

Three parts: get the certificate, back it up to a .p12 file, and put it into Parafa. Do the first two on the computer where you asked for the certificate.

Before you start

You need a qualified certificate for electronic signature from a Czech provider, stored on your computer — not on a chip card, a USB token or your eObčanka. A key on a card or token can never be copied to a file, so Parafa cannot use it.

Three things that catch almost everyone

  • Same computer, same user account. The certificate can be installed only where its key was made — the computer and the user account you asked for it on. Elsewhere it arrives without its key and cannot sign.
  • Make the backup now. Without a .p12 backup, a broken disk or a reinstalled computer means paying for a new certificate.
  • The .p12 password is yours. You choose it when you make the backup. Nobody, not even the provider, can tell it to you later. Write it down.

1. Get the certificate

Every provider checks your identity once, in person or through a verified online identity. A certificate is valid for a year (PostSignum also offers three) and is paid again when renewed. Pick your provider:

PostSignum (Czech Post)

Through Czech Post's free iSignum app: on a Mac from the Mac App Store (macOS 15 or later), on Windows as iSignum.exe, which runs without installing.

  1. In iSignum, click Nový certifikát (New certificate), choose the qualified certificate for a person, and fill in your details. The request ID comes by text message.
  2. Take the request ID and your ID card to a Czech Post branch with Czech POINT. Or, without the branch, use Certifikát Online with an eObčanka with an active chip and a reader, or a MojeID account of the high level.
  3. Once it is issued, on the same computer and user account: in iSignum Stažení certifikátu (Download certificate), then Přijmout a instalovat (Accept and install).

PostSignum's guides: iSignum for macOS · working with certificates

I.CA

On a Mac or a Windows PC, in Chrome, Edge or Firefox — not Safari.

  1. Install I.CA PKIServiceHost and the I.CA extension for your browser, then restart the browser.
  2. On ica.cz, request the qualified certificate for electronic signature. When asked where the key goes, choose that it bude uložen ve vašem počítači (is stored in your computer) — not a card, not an eObčanka. Leave the other options as they are.
  3. The request number comes by text message. Take it to an I.CA registration office, or verify your identity online if the form offers it.
  4. Install the issued certificate on the same computer, in the same browser.

I.CA's guide: first certificate request (PDF)

eIdentity

Windows only: eIdentity does not support macOS. A Mac user needs a Windows PC (or Windows in a virtual machine) for this part, then moves the .p12 to the Mac.

  1. In Chrome or Edge, install eIdentity's browser extension and its host app.
  2. Register on eidentity.cz and create the request; the key is made on this PC.
  3. Visit an eIdentity registration point in person.
  4. The certificate is issued into your account on the web. Install it on the same PC, in the same browser.

eIdentity's help: technical support

2. Back it up to a .p12 file

A .p12 (also .pfx) file is the certificate together with its private key, locked with a password you choose. It is your backup and the way the certificate gets to an iPhone or iPad. Keep it somewhere safe, and the password apart from it.

With iSignum (PostSignum, Mac and Windows)

  1. In iSignum, choose your certificate (on Windows: Detail).
  2. Click Exportovat PKCS#12 (Export PKCS#12).
  3. Choose a password, then where to save the file.

On a Mac, in Keychain Access (I.CA, or a PostSignum certificate moved to the keychain)

  1. Open Keychain Access: press ⌘-Space and type Keychain Access. (Passwords moved to the Passwords app; certificates stay in Keychain Access.)
  2. On the left choose login, at the top My Certificates.
  3. Click the triangle next to your certificate. A private key must appear under it — without it, this Mac cannot back it up.
  4. Select the certificate and choose File ▸ Export Items….
  5. Format Personal Information Exchange (.p12), choose where, click Save.
  6. Choose the password for the file, twice. Then type your Mac's password and click Always Allow.

If Export Items… is dimmed or .p12 is not offered, the key here cannot be exported — it was made non-exportable, or it is not on this Mac.

On Windows (I.CA, eIdentity, or PostSignum without iSignum)

  1. Press Windows-R, type certmgr.msc and press Enter.
  2. Open Personal ▸ Certificates.
  3. Right-click your certificate: All Tasks ▸ Export…, then Next.
  4. Choose Yes, export the private key.
  5. Keep Personal Information Exchange – PKCS #12 (.PFX) and tick Include all certificates in the certification path if possible.
  6. Tick Password, type it twice, and choose the encryption AES256-SHA256.
  7. Choose the file name and place, then Finish.

If “Yes, export the private key” is greyed out, the key was made non-exportable or is not on this PC. There is no way around it: the provider issues a new certificate.

The providers' own backup guides: PostSignum (iSignum) · I.CA on a Mac · I.CA on Windows

3. Put it into Parafa

On a Mac

Parafa signs with the certificates in your login keychain; there is nothing to import in Parafa itself.

  • I.CA: the certificate is in the keychain already.
  • PostSignum: in iSignum, click Exportovat do Klíčenky (Export to Keychain).
  • A .p12 file (from eIdentity on a PC, or a backup): double-click it, choose the login keychain, and type the file's password. Not the System keychain: there macOS asks for an administrator at every signature.

Open Parafa ▸ Settings ▸ Certificates: the certificate is listed with its end date. At the first signature macOS asks whether Parafa may use the certificate's key — choose Always Allow. It does not ask again; from then on Parafa asks for Touch ID (or your Mac's password) at each signature.

Do not drag a certificate or key between keychains in Keychain Access: the key keeps its old permissions and signing is refused. Import the .p12 file again instead.

On an iPhone or iPad

  1. Put the .p12 file into Files first. Parafa does not open it straight from Mail or AirDrop. AirDrop puts it in Downloads in Files; from Mail, tap the attachment, then Share ▸ Save to Files; or save it to iCloud Drive on the Mac.
  2. In Parafa, tap the gear on Home: Settings ▸ Certificates ▸ Import Certificate…, and choose the file.
  3. Type the password the .p12 file was exported with and tap Import.
  4. The certificate appears in the list with its issuer and end date. Allow notifications when asked: Parafa reminds you before the certificate ends.

If it says The password is not correct, it is the password chosen at the backup, not your device's. If it says The file contains no certificate with a private key, the file is a bare certificate (.cer) or was exported without its key — go back to part 2.

The certificate stays on this device only: not in iCloud Keychain, not in a backup. Each iPhone and iPad imports the .p12 file itself. Every signature asks for Face ID or Touch ID, with your passcode as the fallback.

Then make a profile: the certificate with its stamp, reason and location. You choose a profile when signing.

After a renewal

A renewed certificate is a new certificate with a new key, requested while the old one is still valid. Make a new .p12 backup and put the new certificate into Parafa the same way — on an iPhone and iPad, import the new .p12 on each. Parafa recognises it and, after a test signature, offers to move your profiles to it. It reminds you 30 and 7 days before a certificate ends.

26 October 2026

Back to the front page