Either upon request or automatically for the extension of the X.509 certificate, you will receive an e-mail with the subject
“[TGIC] – Activation/Change of the X.509 Authentication of the TGIC User Account XXXXXXXX”. This e-mail contains a link for downloading the new certificate for authentication via X.509. Start the download.

Enter the serial number of the certificate (received in the e-mail) and the one-time password (in a separate e-mail OR by mail).
Example:
Serial number: 8507
PW: z64z-r2R#v8c

Start the download via Download PKCS#12. Do not activate the certificate yet. Leave the browser window open; this will make activation easier later.

Navigate in the backend of your learning environment to Administration → PKCS#12 Certificates and click on Create. The PKCS#12 Certificate wizard opens.

Assign a title such as gut beraten 2026 and a use case.

On the Configuration tab, click on the Upload certificate button and upload the downloaded PKCS#12 file. This file will then be converted to Base64.
Under Key name, enter the number of the TGIC user account. You will find this number as the entry “TGIC User Account: XXXXXXX” in the e-mail from TGIC.
For Password, please enter the new password of the certificate from the e-mail with the download link to the PKCS#12 certificate.
If you have entered both details correctly, the start and end date for the one-year validity will now be displayed below under Validity.

Save. Switch to the Configuration tab in the PKCS#12 Certificate wizard. Copy the text from the PKCS#12 Certificate field.

Now go to Administration → System settings and open the system setting insuranceDistributionDirective. The wizard for system settings opens.

For the appropriate IDD-gut-beraten profile configuration (Note: There may be multiple profile configurations) with the appropriate tgicUser entry (1.tgicUser=8777776519), you must store the certificate base64-encoded. You will find the appropriate value for the tgicUser, with which you determine the appropriate IDD-gut-beraten profile, after the entry “TGIC User Account: XXXXXXX” in the e-mail from TGIC.

Once you have found the appropriate profile, insert the base64-encoded text from the clipboard after “1.p12Temp=”, i.e., the copied text from the text field on the Configuration tab in the PKCS#12 Certificate wizard. Here, “1.” may vary depending on the number of IDD-gut-beraten profiles (e.g., 4.etc.). Find the appropriate entry “X.p12Temp=” and then delete everything after the equals sign. Then copy the new certificate text from the text field above.

In the same profile, store the new password of the certificate under “x.keyPassword=#44of79.fhUh”: s5zz1Q9q5#y?
from the e-mail with the download link to the PKCS#12 certificate.

Then save.

If you still have the TIC-PKI tab open in the browser (see step 2), where you downloaded the certificate (PKCS#12 file), you can now click on Activate certificate there. If you have closed the browser tab, repeat steps 1 and 2. You can use the “one-time password” as many times as you like until the certificate has been activated.

Finally, the message Your X.509 certificate has been successfully activated is displayed. The certificate is now valid.
If the old certificate had already expired because the renewal of the X.509 certificate was carried out too late, the new certificate is valid immediately. Nevertheless, you should activate the certificate for safety reasons