New Thales ID Cards in Estonia 2025

Starting in November 2025, Thales will replace IDEMIA as the producer of Estonia’s ID-cards. The trust services for the new Thales ID-cards will be provided by Zetes. Starting in March 2025, Thales test cards will be available to e-service providers for testing ID-card authentication and digital signing solutions.

To support Thales test ID-cards in an application that uses ID-card authentication with Web eID, you must add the TestESTEID2025.crt intermediate CA certificate to the list of trusted intermediate certificate authorities. The TestESTEID2025.crt certificate is available here: https://installer.id.ee/media/id2025/TestChain/.

The recommended approach is to use a truststore file to load the CA certificate as demonstrated in the Web eID Spring Boot example application. Alternatively, you can use the eu.webeid.security.certificate.CertificateLoader helper class to load it from resources.

All trusted certificates, including the new one loaded from TestESTEID2025.crt, must be provided as arguments to AuthTokenValidatorBuilder().withTrustedCertificateAuthorities().

Here is the example application pull request that adds TestESTEID2025.crt to trusted certificates in the dev profile: https://github.com/web-eid/web-eid-spring-boot-example/pull/59.
Note that the example application automatically loads all certificates from the respective resources directory.