Digital Certificates in Tunisia: Types, Providers, and Costs in 2026

Before transmitting a single electronic invoice to the TTN platform, every Tunisian company must answer a concrete question: who digitally signs this document, and with what? The answer comes down to two words — qualified certificate. But behind this administrative formulation lie technical and budgetary choices that merit serious analysis. Between a USB token at 350 TND and a mobile signature with reload packs, the decision is not trivial for an SME issuing twenty invoices a month or a mid-sized company processing three hundred.

This guide covers the complete ecosystem: what a qualified certificate is under Tunisian law, how TUNTRUST structures this market, which products are available, where to purchase them, and what everything actually costs once ancillary fees are accounted for.

The Legal Framework: ANCE at the Center of the System

Tunisian Law No. 2000-83 of August 9, 2000 on electronic exchanges and e-commerce established the foundations of digital signatures in Tunisia. It entrusts the Agence Nationale de Certification Électronique (ANCE) with the role of regulator and supervisory authority for the entire digital trust chain.

Concretely, ANCE is responsible for accrediting certification service providers, establishing the technical standards these providers must meet, and maintaining a public registry of issued and revoked certificates. A certificate is termed "qualified" when it is issued by an ANCE-accredited provider, following strict identity verification procedures and under technical conditions defined by law.

This qualified status is indispensable for electronic invoicing. The TEIF system (Tunisian Electronic Invoice Framework) mandated by Decree-Law No. 2022-61 requires that each invoice be signed with a qualified certificate. A signature using a self-signed certificate or a certificate from a non-accredited authority would be rejected by the TTN platform.

TUNTRUST: Tunisia's Root Certification Authority

TUNTRUST is the only certification service provider currently accredited by ANCE in Tunisia. It acts as the Root Certification Authority (Root CA): all qualified certificates issued in Tunisia for electronic invoicing descend from its chain of trust.

Operating under the oversight of the Agence de Promotion de l'Industrie et de l'Innovation (APII), TUNTRUST markets its certificates primarily online through two distinct portals depending on the type of certificate sought. Its monopolistic position in this segment — at least until other providers obtain accreditation — means that product selection occurs among its own offerings, even when purchasing through an authorized reseller.

Available Certificate Types

ID-Trust: The USB Token for Higher Volumes

ID-Trust is a certificate stored on a cryptographic USB token (a secure hardware key). It is TUNTRUST's legacy product, designed for companies that need a robust, autonomous signature solution without dependence on an OTP package.

Price: 350 TND excl. VAT for a 2-year validity, plus 7 TND in shipping fees.

This certificate is particularly suited to the EDI mode of TEIF electronic invoicing, where invoices are transmitted in batches through an integrated management software. The USB token plugs into the accountant's workstation or server, and signing occurs locally without depending on a mobile network or smartphone battery.

ID-Trust suits companies with a moderate to high monthly invoice volume — typically above 100 invoices per month — where the per-signature OTP cost would quickly become prohibitive. It is also the natural choice for companies seeking to integrate signing into an automated workflow via their ERP or accounting software.

Obtaining it: Directly at ecert.tuntrust.tn after verification of the legal representative's identity and the company's commercial registration.

DigiGo: The Mobile Signature for Smaller Structures

DigiGo is a mobile electronic signature solution accessible via a smartphone application. The certificate is stored in a secure server-side digital vault, and each signing action is authorized by a one-time password (OTP) sent to the user's phone.

Subscription price: 50 TND excl. VAT for 2 years, then OTP packs to reload according to volume:

Each OTP corresponds to one signing action — meaning, in practice, one signed invoice. For a micro-enterprise issuing 15 to 20 invoices per month, the 200-OTP pack represents approximately 8 months of use for 50 TND, which remains very affordable.

DigiGo is the natural choice for the Web mode of the TTN platform, where invoices are entered directly in the online interface and signed on the fly. It suits freelancers, sole traders, and small structures without an IT department.

Obtaining it: At digigo.tuntrust.tn or through authorized resellers (see below).

DigiGo-Poste: The La Poste Tunisienne Variant

DigiGo-Poste is technically identical to DigiGo but distributed by La Poste Tunisienne through its branch network. For business owners who prefer handling this process in person rather than online, or who already have an established relationship with La Poste for their financial services, this is a practical alternative.

Pricing conditions are aligned with those of standard DigiGo. Identity verification takes place at a post office branch, which may provide additional assurance for those apprehensive about fully digital processes.

Seal: The Server Certificate for Automated Volumes

The Seal certificate is an electronic seal certificate issued in the name of a legal entity (the company itself, rather than a physical representative). It is designed to be installed on an application server and trigger automated signatures at scale, without human intervention at each signing.

This product targets large enterprises and software publishers that integrate electronic invoicing directly into their ERP via the TTN API. It corresponds to the scenario where a company's information system issues hundreds or thousands of invoices per day in a fully automated manner.

The Seal certificate price is available on request from TUNTRUST, with conditions varying by volume and use case.

The DigiGo Reseller Network

For DigiGo, TUNTRUST has developed a network of authorized resellers and distributors that provide alternative — sometimes more convenient — procurement channels:

• Flouci — mobile payment solution, accessible via the application
• Shadoc.io — document management and signature platform
• NGSign — TUNTRUST-approved signing middleware, TTN partner
• UIB Bank — for UIB customers
• STB Bank — for STB customers
• Attijari Bank — for Attijari customers

Important: certificates distributed through banks are reserved for customers of those institutions. If you are not a UIB customer, you cannot obtain a DigiGo certificate through UIB. Non-bank distributors such as Flouci, Shadoc.io, or NGSign, however, are accessible without an account requirement.

Verifying Certificate Validity

TUNTRUST provides a public verification tool through its LDAP search (Lightweight Directory Access Protocol) at https://www.tuntrust.tn/LdapSearch/.

This tool allows any certificate to be searched by holder name or serial number, and its status verified: valid, suspended, or revoked. It is useful not only for checking your own certificate before an important deadline, but also for validating a business partner's certificate if needed.

Supported Signature Standards

TEIF electronic invoicing accepts three digital signature formats, all based on European CAdES/XAdES/PAdES standards adapted to the Tunisian context:

• XAdES (XML Advanced Electronic Signatures): signature format for XML files, the most commonly used in TEIF since electronic invoices are structured in XML
• PAdES (PDF Advanced Electronic Signatures): for PDF representations of invoices
• CAdES (CMS Advanced Electronic Signatures): generic format for any file type

In practice, TEIF-approved software handles these standards transparently. As a user, you will not need to manually choose the signature format — the software handles this based on the file type.

The TTN Double-Signature System

A technical point often misunderstood: when an electronic invoice is submitted to the TTN platform, it receives two successive signatures.

The first is that of the issuer (your company), applied via your TUNTRUST certificate prior to transmission. This signature authenticates the invoice's origin and guarantees its integrity.

The second is a counter-signature by TTN itself, which the platform applies automatically after receipt and validation. This counter-signature constitutes the legal acknowledgment of receipt and gives the invoice its legally binding character vis-à-vis the tax authorities.

The final invoice — the one you transmit to your customer — carries both signatures. The recipient can thus verify both the authenticity of your signature and the administration's reception stamp.

Planning Renewals and Anticipating Lead Times

TUNTRUST certificates have a validity period of 2 years. An expired certificate makes it impossible to sign invoices, which can completely block the commercial activity of a company subject to the electronic invoicing obligation.

Key points to anticipate:

For ID-Trust, USB tokens are sometimes out of stock, particularly during periods of high demand (at the start of the fiscal year or around TEIF extension deadlines). It is advisable to begin the renewal process at least 3 months before expiration.

For DigiGo, renewal is simpler because there is no hardware to receive. However, you must monitor your OTP balance independently of the certificate's expiration date — an exhausted balance blocks signatures even if the certificate is still valid.

TUNTRUST sends expiration notifications by email, but it is prudent not to rely on these exclusively. Add an alert to your administrative management calendar.

Approved Signing Applications

Having a certificate is not sufficient: you also need software capable of using it to sign invoices in TEIF format. Three applications have obtained TTN approval for signing:

• Discovery E-Sign — TUNTRUST-certified solution, compatible with ID-Trust and DigiGo
• NGSign — signing middleware developed by NGSign, available as SaaS or on-premise
• Shadoc.io — document platform integrating TEIF signing

These tools can be used independently or as a complement to an existing invoicing software that does not itself manage the signing layer.

Total Cost Summary

To properly budget the certificate investment in the context of electronic invoicing, several cost items must be added up:

For low volumes (fewer than 50 invoices per month), DigiGo remains less expensive. Beyond that threshold, ID-Trust becomes more economical because there is no marginal cost per signature.

These figures do not include the cost of invoicing software itself, nor any technical integration fees if you choose a custom solution.

Key Takeaways

The choice of digital certificate is not an administrative formality — it is a structuring decision for how your electronic invoicing will be organized. A small structure that manually signs each invoice from a browser will choose DigiGo. A company that wants to integrate invoicing into its management software and sign batches of invoices automatically will choose ID-Trust or Seal.

In all cases, TUNTRUST remains the mandatory gateway. Identify your monthly invoice volume, choose your transmission mode (Web or EDI/API), then calculate the total cost over 2 years — the decision becomes straightforward.

This article is part of the Electronic Invoicing in Tunisia series. Find the previous episode on the legal framework and penalties for electronic invoicing in Tunisia, and the next episode on the step-by-step guide to enrolling on the El Fatoora platform.