Getting a qualified electronic signature in Bulgaria

Official documents and institutions · Last reviewed: 2026-08-23

Three levels, one legal equivalence

EU law recognises simple, advanced and qualified electronic signatures, and the difference is not cosmetic. Only the qualified signature — built on a qualified certificate and a qualified signature creation device — carries the legal effect of a handwritten signature, and a signature qualified in one Member State is qualified in all of them. "I have an electronic signature" therefore tells an institution nothing; the questions are whether it is qualified and which provider issued it.

The legal framework is Regulation (EU) No 910/2014, amended by Regulation (EU) 2024/1183 establishing the European Digital Identity Framework.

Verifying the provider

The supervisory body for electronic trust services in Bulgaria is the Communications Regulation Commission (CRC). It creates, maintains and publishes the national trusted list under Article 22 of Regulation 910/2014, updating it on every change and at least once every six months.

As of 23 August 2026, five qualified trust service providers were entered in the Bulgarian trusted list: Borica AD, Evrotrust Technologies AD, Infonotary EAD, Information Services AD and Idox Bulgaria EOOD. (Source: CRC, retrieved 23 August 2026. The list changes — confirm it on the CRC page before you buy.)

The identifier inside the certificate

This is the costliest mistake foreign users make. Bulgarian institutions match you not by name but by identification number — the EGN for citizens, the LNCh for foreign nationals. If the number is missing from your certificate, the signature works flawlessly in cryptographic terms yet the institution's system cannot tell who signed, and it refuses you.

A concrete example: the electronic criminal record service authenticates you with a signature whose certificate contains the identification number and which was issued by a Bulgarian provider. The same logic applies to many revenue and municipal services.

• •Fill in the identification number field when ordering; it cannot be edited into the certificate afterwards.
• •If you do not have an LNCh yet, that is step one and the signature is step two.
• •Make sure the spelling of your name matches the record held by the institution you will use.
• •When you receive the certificate, open its properties and confirm the number is actually there.

Choosing a carrier

The deciding question is where and how often you will sign. A few signatures a year from the same desktop: a card or token is fine. Company work, travel, or a machine where driver installation is painful: cloud or mobile signing removes the problem entirely.

Buying it, step by step

1. 1

   Define the scope

   A personal signature and one that binds you as a company representative are different certificates with different contents.
2. 2

   Verify the provider

   In the CRC trusted list and in the European Commission's trusted list browser — two independent checks.
3. 3

   Attend identity verification

   Identity checking is mandatory for a qualified certificate: in person at a registration office, or remotely where the provider offers it. Bring your ID and, as a foreign national, your residence document.
4. 4

   Confirm the certificate content in writing

   Name spelling, identification number, email and company data are embedded and cannot be edited later.
5. 5

   Change the initial PIN

   Store the PUK separately and safely; the device locks after a set number of wrong PIN entries.
6. 6

   Install and TEST it

   Download drivers from the provider's own page and test the signature before a real deadline, not on the day of filing.

Cost: why we give no figure

An electronic signature is not a state fee but a commercial service: the price depends on the provider, the certificate term, the carrier type and the bundle, and it moves with promotions. Rather than a misleading number, here is what to compare:

• •The certificate itself and its validity term — longer terms usually lower the annual cost.
• •The carrier hardware: card, reader or token; cloud signing has none.
• •How identity is verified — remote verification is sometimes charged separately.
• •Renewal pricing and any discount for renewing before expiry.
• •Separate pricing for certificates issued for legal entities.
• •All payments are in euro.

When the signature does not work

1. 1

   Has the certificate expired

   An expired certificate simply stops working, usually without a clear message.
2. 2

   Is the identification number present

   The most misleading failure, because the signature itself is technically fine.
3. 3

   Are the root certificates installed

   Without the chain of trust, the signature is displayed as invalid.
4. 4

   Is the browser supported

   Some public portals work only with specific browsers.
5. 5

   Is the computer's clock correct

   Timestamp validation can fail on a wrong system time.
6. 6

   Is it authority, not signature, that is missing

   Acting for a company may require a registered representation with the institution, separate from the signature.

Loss, theft and staff changes

If the card, token or phone is lost, the only correct action is to have the certificate suspended or revoked immediately. Your provider has a notification channel; note it on the day you buy, not on the day you lose it. A qualified signature has the weight of your handwriting: in someone else's hands it is a signed blank page.

• •Revoke the certificate of a departing company representative rather than assuming it will not be used.
• •Give your accountant their own authorisation instead of lending your signature.
• •Never share the PIN — denying authorship of a qualified signature is difficult.
• •Plan renewal weeks ahead; an expired signature is discovered on filing day.

The no-signature alternative

Not every electronic service needs a qualified signature. The revenue agency and the social security institute issue personal access codes that cover their own services and portal authentication. They are free of hardware and collected at an office; the limit is scope — a code cannot sign a contract or file where a qualified signature is required.

What comes next: the EU digital identity wallet

Regulation (EU) 2024/1183 establishes the European Digital Identity Framework. Every Member State is to provide at least one European Digital Identity Wallet by December 2026 to all citizens and residents in the EU; issuing, using and validating the wallet is free for individuals, and use remains voluntary. (Source: European Commission, retrieved 23 August 2026.)

If you need a signature now, there is no reason to wait: the wallet will sit alongside qualified signatures rather than replace them. It is worth knowing when weighing a long certificate term.

Signed file formats and timestamps

"I signed the document" does not describe one single output. An electronic signature can be embedded in the document — a signed PDF — or produced as a separate detached file, and some institutions accept only one of the two. When a filing is rejected as "invalid signature", the cause is frequently not the signature but the format of the file you sent.

• •Check the accepted format before filing; service pages usually state it.
• •Do not confuse embedded with detached signatures — a detached signature means sending two files together.
• •Editing a document after signing breaks the signature; finish the text first.
• •Signing a scan does not turn the scan into an original; the signature binds the file, not the paper behind it.

A timestamp is a separate and valuable addition: it proves independently that the signature existed at a particular moment. The benefit shows up after your certificate expires — a timestamped signature continues to validate against its validity at the time of signing. Ask for timestamps on documents meant to live a long time, such as contracts and corporate resolutions.

Signatures for a company: who signs what

For a business owner, a signature is not one purchase but an architecture of authority. Keep three questions apart: who holds a certificate, whether that certificate is linked to the company, and whether that person is REGISTERED as authorised with the institution concerned. Failures usually sit in the third.

1. 1

   The representative's own certificate

   Issued so that it reflects the representation relationship with the company.
2. 2

   Separate authority for the accountant

   The accountant works with their own certificate under delegated authority — never with your signature.
3. 3

   Registering the authority with the institution

   Who may file on whose behalf is declared separately; this is an application, not a signature setting.
4. 4

   Revoke on change

   When a representative or accountant changes, update both the certificate and the institutional registration.

First-week checklist

• •Open the certificate properties and confirm the identification number is there.
• •Put the expiry date in your calendar with a reminder a month before.
• •Store the PUK away from the PIN.
• •Save the provider's support and revocation channel in your phone.
• •Install the root certificates and make one test signature.
• •Log in once to each portal you will actually use, and confirm it works.

A short Bulgarian glossary

Provider pages and institutional forms are in Bulgarian. Recognising a dozen terms makes comparing offers and filling in forms dramatically easier.

Seven questions to ask a provider

1. 1

   Will my identification number appear in the certificate

   The decisive question for a foreign national; get the answer in writing.
2. 2

   Where does identity verification happen

   In person or remotely, and with which documents.
3. 3

   Which operating systems and browsers are supported

   Ask before buying if you use macOS or Linux.
4. 4

   Are timestamps included

   Needed if you will sign documents meant to last.
5. 5

   Do I need a separate certificate for the company

   Clarify before any commercial register filing.
6. 6

   What is the revocation channel if it is lost

   Phone or online, and during which hours.
7. 7

   How does renewal work

   Ease of renewal before expiry determines your second-year cost.

Renewal, migration and retirement

A certificate has a limited life, and when it ends the signature stops working, usually without a helpful message. Renewing before expiry is generally simpler — the identity step may be lighter and there is no gap in service. After expiry the process often restarts from the beginning. Setting a calendar reminder is the cheapest advice in this article.

• •Changing computers means reinstalling drivers and root certificates; the certificate itself lives on the card or token.
• •With cloud signing, changing devices usually just means logging in again — a real advantage for frequent travellers.
• •If you will stop using a signature, revoke it rather than letting it lapse.
• •A departing employee's certificate should be revoked on the day they leave.

Where to keep it, and where not to

Treat a qualified signature as a physical key. A card in a drawer with the PIN written on it is a locked door with the key left in the lock. The working arrangement is simple: the carrier in one place, the PIN in your head, the PUK separately and securely. Never leave the token plugged into a shared computer; remove it when you finish. The same logic applies to cloud signing — your phone's lock screen has become the door to your signature.

Three user profiles: which do you need

1. 1

   An employed individual

   Your need is usually querying: tax status, insurance record, municipal certificates. Institutional access codes are often enough and are free. Buy a qualified signature when a signature-dependent service such as the electronic criminal record actually appears.
2. 2

   A freelancer

   You file declarations and sign contracts, often remotely. Here a qualified signature is a genuine time saving, and the cloud or mobile form is the most practical. Ask for timestamps too — contracts outlive certificates.
3. 3

   A company owner

   Commercial register filings do not work without a signature, and electronic filing carries a lower state fee. You also need an authority architecture: your own certificate, separate delegated rights for the accountant, and registrations with each institution.

What works without a signature

Checklist

• •I verified the provider against the regulator's trusted list.
• •I have written confirmation that my identification number will be in the certificate.
• •I asked whether my operating system and browser are supported.
• •I chose the carrier type to match how I actually work.
• •I changed the PIN and stored the PUK separately.
• •I installed the root certificates and made a test signature.
• •The expiry date is in my calendar with a reminder a month before.
• •The revocation contact is saved in my phone.

Frequently asked questions

Related topics