Help

AutoFirma on Mac: why it fails and where DNIe for Mac fits

Guide updated: 29 September 2026 · by David Pelayo (nexoapex)

When AutoFirma isn't working on a Mac, the usual failures fall into five groups: macOS won't let it open or it won't start (Gatekeeper, Apple Silicon, a merged install); the Mac or AutoFirma can't see the card reader; AutoFirma can't see the certificate ("No se han encontrado certificados válidos en el almacén", meaning no valid certificates were found); the browser can't connect to it ("No se pudo contactar con AutoFirma", meaning it could not contact AutoFirma, or error SAF_45); or the DNIe certificate has expired or the PIN is blocked. Below, how to tell each case apart.

AutoFirma is the Spanish government's official e-signature application, and many government sites invoke it directly to sign a submission. DNIe for Mac doesn't force it out: it's interoperable with AutoFirma, and it also handles browser sign-in (with DNIe Pro) and standalone document signing on its own, without leaving your Mac.

What is AutoFirma?

AutoFirma is the e-signature client distributed free of charge by the Government of Spain. Many Spanish e-government sites (the Tax Agency, Social Security, the DGT and others) invoke it from the browser when a submission needs to be signed on the spot. DNIe for Mac is not AutoFirma or an official substitute for it: it's an independent application by nexoapex that reads your DNIe, signs you in and signs documents on its own.

AutoFirma isn't working on your Mac: the most common failures

These are the usual reasons AutoFirma fails on macOS, and how to tell whether the problem is AutoFirma itself, your card reader, or the DNIe card. For faults in AutoFirma proper, the authoritative source is its official site; what follows helps you locate where the problem actually is.

macOS won't let AutoFirma open (unidentified developer or malicious software)

That's Gatekeeper, macOS's app control, not a bug in the program. Since macOS 15 Sequoia, Apple no longer lets you get past the block by opening the app with Control-click (or right-click) → Open. Try to open it once, go to System Settings → Privacy & Security, scroll down to Security and click Open Anyway: the button stays there for about an hour after the attempt. Enter your login password and macOS saves AutoFirma as an exception; from then on it opens with a double-click, as the Mac User Guide explains. On macOS 13 Ventura and 14 Sonoma, Control-clicking (or right-clicking) the app in the Finder, choosing Open and confirming also works. Always download AutoFirma from the government's official site, never from a third-party mirror.

AutoFirma doesn't show your DNIe certificate

This is the most common failure on Mac, and there are three layers to rule out in order: that macOS recognizes the reader, that the card can be read, and that the certificate store AutoFirma uses can see the DNIe. To separate the first two from the third: if DNIe for Mac reads your card and shows your data and the state of your certificates, the reader and the card are fine and what's left is AutoFirma configuration. If it can't see them either, the problem is upstream — the reader or the card.

Your Mac doesn't recognize the card reader

Contact readers that follow CCID work on macOS with no drivers to install. Check under Apple menu → About This Mac → More Info → System Report → USB: the reader must appear in the list. If it doesn't, try another port or cable and avoid unpowered hubs. Insert the card chip-first, all the way in. If you are choosing a reader, or unsure whether yours will do, the full guide is which DNIe card readers work on a Mac.

macOS sees the reader but AutoFirma says there is none

Worth separating from the case above: the reader is fine and macOS recognizes it, but the Java runtime bundled inside AutoFirma never reaches it, and the app logs "no card readers detected on the system" or a card-not-present error. To confirm macOS sees it, run system_profiler SPSmartCardsDataType in Terminal: your reader must appear under Readers.

If it does and AutoFirma still doesn't see it, the fault is neither your reader nor the card, and no hardware setting will fix it: it belongs to AutoFirma, and the fix belongs to firmaelectronica.gob.es. It's reported in issue 523 of AutoFirma's official repository. DNIe for Mac doesn't go through Java: it talks to the reader through CryptoTokenKit, the macOS smart-card layer.

AutoFirma throws a Java error

Current AutoFirma builds for macOS ship their own Java runtime, so reinstalling the current version from the official site usually clears Java errors inherited from an older install that relied on a system Java. DNIe for Mac uses no Java at all — it is a native macOS app.

AutoFirma won't open on an Apple Silicon Mac (M1, M2, M3, M4, M5 or MacBook Neo)

AutoFirma ships in two Mac builds, one for Intel and one for Apple Silicon. Depending on which one you install, macOS may ask for Rosetta 2 to run Intel-compiled components; if the app never opens, install it from Terminal with softwareupdate --install-rosetta and try again. Apple warns in the macOS 27 release notes that the upgrade doesn't restore Rosetta, even if it was already on your Mac. If AutoFirma stops opening after the upgrade, run that command again or, better, install the Apple Silicon build of AutoFirma (on the official site, "para MacOS procesadores M1 y siguientes", for M1 and later processors). The same notes warn that Intel-based software will no longer be compatible with macOS 28, except legacy games. DNIe for Mac runs natively on Apple Silicon and needs no Rosetta.

The browser launches AutoFirma, then says it can't reach it

After the certificate problem, this is the most frequently reported failure. The government site opens an afirma:// link, AutoFirma starts in the background and opens a small local server; the browser then has to connect to it over wss://127.0.0.1 using an SSL certificate that the AutoFirma installer generates on your Mac and adds to the keychain. If that certificate is missing or untrusted, the browser drops the connection and you get "No se pudo contactar con AutoFirma" (could not contact AutoFirma) even though the app is open.

What works for most people is AutoFirma's own repair function: Herramientas → Restaurar instalación (Tools → Restore installation). If that doesn't complete, install the certificates by hand: open ~/Library/Application Support/AutoFirma, double-click AutoFirma_ROOT.cer and autofirma.cer, then in Keychain Access → System → Certificates set both to Always Trust (the second one shows up as "127.0.0.1" or as "localhost", depending on the install). Don't go looking for a fixed port such as 8080: AutoFirma opens dynamic ports and they change on every attempt. On macOS Tahoe there is also an issue, 551, opened on 31 July 2026 and still open on 16 September: a user of AutoFirma 1.9.2 on macOS 26.5, on an Apple Silicon Mac, reports that AutoFirma never opens its local communication service. A project contributor suggested restoring the installation, accepting the browser's permission prompt and updating to macOS Tahoe 26.6.

Chrome and Edge add one more cause. To the browser, a page that connects to 127.0.0.1 (your own Mac) is reaching into the local network, and that needs your permission. Since version 147, released in April 2026, Chrome and Edge also ask for it on WebSocket connections, which are AutoFirma's main channel. It isn't a window that blocks the page but a small notice that, according to that same AutoFirma contributor, usually shows up in the top-left corner. It asks for access to other apps and services on your device or, in some versions, to devices on your local network; the exact wording depends on the version and the browser. If you ignore or deny it, the government site can't talk to AutoFirma and shows a connection error, such as "No se pudo contactar con AutoFirma", even though the certificate is fine. Accept it and retry the submission; if you already denied it, check that site's permissions in the browser settings.

AutoFirma reports error SAF_45 (could not open a socket)

Same scenario, seen from AutoFirma's side: the app starts but can't start its local server, because it can't read the key store it uses to encrypt that connection. On macOS this has been traced to the installer leaving ~/Library/Application Support/AutoFirma owned by root, so your own user can't open it. It's reported in issue 488 of AutoFirma's official repository.

Check it in Terminal with ls -ld ~/Library/Application\ Support/AutoFirma. If the owner is root, hand it back to your user with sudo chown -R "$(whoami):staff" ~/Library/Application\ Support/AutoFirma and retry the submission. AutoFirma's own log, at ~/.afirma/AUTOFIRMA.afirma.log.xml, records the failed socket right before the SAF_45.

AutoFirma stops opening after you restart the Mac

This happens when you install a new version on top of an older one. The macOS disk isn't case-sensitive, so AutoFirma.app and Autofirma.app are the same folder and the installer can merge both versions, leaving stale files that don't match the new code signature. It keeps working until you restart; after that macOS refuses it and says the app can't be opened. It's reported in issue 524 of AutoFirma's official repository.

Check it in Terminal with codesign -vv /Applications/AutoFirma.app: if it answers "a sealed resource is missing or invalid", the bundle is merged. The way out is to drag the app to the Trash, empty it, and install again from the official site without keeping the previous install.

AutoFirma 1.9 and 1.9.1 could leave the login keychain unusable

On macOS Tahoe 26.4 and 26.4.1, installing or restoring those versions could render the login keychain inaccessible: the system starts asking for its password and rejecting it, and after a restart you get a new, empty keychain. The old one stays in ~/Library/Keychains with "rename" added to its name, but no longer opens. It's reported in issue 512 of AutoFirma's official repository, where its team explains that the failure doesn't occur on macOS 26.5 and that AutoFirma 1.9.2 stops using the operation that caused it. Watch out when you download it: as of 16 September 2026, the official downloads page shows 1.9.1 as the main Mac version, and 1.9.2 appears further down, after "Versiones anteriores" (previous versions), under its own "Tahoe 26.4 /26.4.1" label. If you're still on macOS 26.4 or 26.4.1, install that 1.9.2 or, better, update macOS.

What you lose are the stored passwords and any software certificates that lived in that keychain; if you have Time Machine, restoring ~/Library/Keychains/login.keychain-db from an earlier backup usually brings them back. DNIe certificates aren't there: they live on the card's chip, so a damaged keychain doesn't take them with it, and they're available again as soon as you plug in the reader with the card in it.

AutoFirma says "No se han encontrado certificados válidos en el almacén" (error SAF_19)

This is what AutoFirma shows when its certificate list comes up empty: "No se han encontrado certificados válidos en el almacén. Inserte una tarjeta inteligente en el lector y pulse Recargar, o cargue un almacén externo" (no valid certificates were found in the store; insert a smart card in the reader and press Reload, or load an external store). Either it finds no certificate in the store it uses, or none of them is valid for that signature, because it has expired or because the government site asked for one specific type of certificate only. Its log records it as "No habia certificados validos en el almacen del usuario" and, when a government site launches the signature, the site receives code SAF_19 ("No hay ningun certificado válido en su almacén", there is no valid certificate in your store), according to the messages and the error handler in AutoFirma's source code. On a Mac, the first thing to establish is whether you sign with the DNIe or with a certificate installed in the keychain.

• With the DNIe. AutoFirma uses the Apple keychain as its store, but the DNIe doesn't depend on it: AutoFirma reads the card with its own Java driver, JMulticard, which is on by default. Check under Herramientas → Preferencias → General (Tools → Preferences → General) that "Habilitar JMulticard para el uso de tarjetas de la FNMT y DNIe" (enable JMulticard for FNMT and DNIe cards) is still checked. According to its installation manual, if it's turned off, AutoFirma needs the card's official driver installed on the system, and the change takes effect the next time you open the app. If it's checked, rule out the reader, the card and certificate expiry, in that order (the certificates last two years, under Royal Decree 255/2025), as the other sections of this guide explain.
• With a software certificate, such as an FNMT one. To tell whether the problem is the certificate or AutoFirma, run security find-identity -v in Terminal: it lists only certificates that still have their private key and can therefore sign. If yours isn't there, it won't sign in any application. With AutoFirma 1.8.3 and 1.8.4, marking the certificate as Always Trust in Keychain Access makes the Java shipped with those versions stop seeing it; setting it back to Use System Defaults in the Trust panel brings it back. The AutoFirma team confirms this in issue 413 of its official repository, and other users describe it in 462.
• On macOS Tahoe with AutoFirma 1.9.2. Two open issues in the official repository show this same symptom, 520 (macOS 26.4.1) and 548 (macOS 26.5.2, an M4 Mac), both on Apple Silicon Macs: software certificates installed in the keychain with their private key don't show up in AutoFirma (in 520, those same certificates work in the browsers). In 548, a project contributor suggested updating to the latest version of macOS Tahoe, and the person who opened the issue replied that the failure persisted after the update. As of 16 September 2026, both are still open.

DNIe for Mac doesn't handle software certificates such as FNMT ones: it works with the DNIe certificates, which are on the card.

The DNIe certificate has expired, or the PIN is blocked

Then it isn't AutoFirma: no application can sign with an expired certificate or a blocked PIN, and the DNIe has no PUK. Both are fixed in person, free and without an appointment, at a DNIe Update Point (PAD). Step by step in our blocked or expired PIN guide.

Is DNIe for Mac an alternative to AutoFirma?

For signing your own documents and validating signatures, yes: DNIe for Mac signs in PAdES, CAdES and XAdES, free and without Java. For submissions where the government site invokes AutoFirma, no: there the site calls it directly to sign, and that doesn't change. Both can be installed on the same Mac, and AutoFirma still reads the DNIe on its own, with JMulticard. Signing in to a government site doesn't need AutoFirma either: with DNIe Pro, your certificate appears in the browser's own dialog, as the DNIe in Safari and Chrome guide explains.

When you use which

AutoFirma and DNIe for Mac, side by side

The AutoFirma row summarizes its public role and cost; for its full feature set, see the official source at firmaelectronica.gob.es.

Do I need to install Java for any of this?

Not for DNIe for Mac: it's a native macOS application, with no Java, no system configuration and no profiles. You only need macOS 13 or later, a USB contact card reader, your DNIe and your PIN. If you're starting from scratch, the guide to installing the DNIe on a Mac explains both routes, the official one and the app.

What about Firefox?

Firefox does not talk to the card through the native macOS integration, but it does read the system's client certificates, and current versions have that on by default. So the DNIe that DNIe for Mac publishes shows up in Firefox too, with no PKCS#11 module to load. If it does not appear on your Mac, the DNIe in Firefox guide covers the official-module route.

More on what DNIe for Mac does or how to get it. If you're looking for help with a blocked PIN or an expired certificate, see the blocked or expired PIN guide.

Have an FNMT software certificate in a .p12 or .pfx file? Follow the digital certificate guide for Mac to import it into Keychain Access. It is different from the DNIe, whose private key stays on the card; the DNIe app does not manage software certificates.