Spain, land of digital fingerprints… and eternal Windows XP

There's a very Spanish myth: that «everything is already digitised». That the electronic portal, the FNMT certificate and the signed PDF are progress. Then you try to file annual accounts and legalise the company books of an SL — and you discover the truth: this isn't digitisation. It's compulsory archaeology with Wi‑Fi.

This article is not a tutorial. It is the diary of what happened to us in July 2026 trying to do something that, in a halfway serious country, should fit into an afternoon: file the year's numbers and legalise two books. Journal and Inventory. Done.

Instead: weeks, tickets, complaints, second-hand Windows machines, abandoned VirtualBox/UTM setups, 401 errors, F5 firewalls, ZIP names that are «valid» according to a ministry and «invalid» according to a portal, an accountant saying one thing and the Commercial Registry another, and official software —Legalia 2, D2— that in 2026 is still Windows only.

No web app. No Mac. No Linux. No real public API. Only the cult of the .msi and Autofirma.

1. Two procedures, two hells (and almost nobody explains it)

For a 21st-century Spanish company there are at least two distinct rituals before the Commercial Registry:

Filing annual accounts.
Legalising the books (Journal, Inventories, etc.).

They are not the same. They do not use the same program. They do not use the same ZIP. Confusing them costs you days.

Accounts filing → D2 (Digital Deposit) → fingerprint ZIP → portal → Autofirma → pay.
Book legalisation → Legalia 2 → another fingerprint ZIP → portal → Autofirma → pay.

Both official from the Registrars' College. Both Windows only. Both filed at sede.registradores.org. Both require being a subscriber user of the telematic filing service.

If you thought an FNMT representative certificate was enough: no. The certificate lets you into the «shop-window» portal. To actually submit, you get the mantra:

«You have identified yourself as a non-subscriber user» — HTTP 401 guest

That is not a one-day bug. It was the wall for days. Ticket WO…………. Registration xxxxxx. User CIRCExxxxxx. Emails to support, ITSM, data management. Follow-ups. Complaints. Calls to 91 270 17 96.

They tell you they have already «linked» the certificate to the subscriber. You log in again. Still 401. You only see «non-subscriber» profiles. You file another complaint: the announced link is NOT effective.

That is not e-government. It is institutional gaslighting with corporate CSS.

2. The subscriber: signup, SEPA, password, and a radio button called «legacy portal»

Once the subscriber finally exists, the login flow looks designed by someone who hates users:

Electronic certificate or Cl@ve or subscriber username/password.
Cert only: sometimes you are a «guest».
Username/password only: sometimes it demands a certificate «registered on the service».
When it works, a radio appears: «legacy portal CIRCExxxxxx». Yes: legacy portal. In 2026. As if progress were a nostalgic radio button.

Meanwhile credentials vanish between email threads, password resets and screenshots. The portal wants a subscriber; the Mac Keychain stores certificate «identity preferences»; nobody stores a human UX.

3. Filing accounts: your perfect ZIP is useless (until D2 blesses it)

We had closed accounts. Numbers balanced. XBRL. PDF. Minutes. Everything validated end to end in our own system.

We uploaded the ZIP. Depending on the day, the portal answered:

«ZIP name is not valid» (400-extraction-validation-19), even after ten naming attempts.
Or worse: upload returns 202, you get a JWT… and when you query the result the F5 WAF spat a 403 HTML: «Your request cannot be processed». Front-end: «It has not been possible to determine the error type.»

In other words: the College's own firewall prevents you from finishing the procedure the College forces you to do. Filing deadline roughly 30/07/2026. Clock ticking.

The unofficial doctrine: the ZIP must come from D2. Not from your accounting. Not from your clean XBRL. From their Windows program generating their fingerprint with their structure. The State does not want your data. It wants your submission to the College's proprietary format.

So: install Windows (or a VM), install D2, import, generate fingerprint, upload the blessed ZIP, Autofirma, pay. When it finally went through, the filing acknowledgement was WEBTxxxxxxxx. A number. Weeks of life for a number.

4. Legalisation: Legalia 2, or how to force you to buy Windows in 2026

Accounts filed, next: legalise the 2025 books.

Theoretical deadline: four months from year-end → 30/04/2026. It is July. Late. The Registry will note it. You still have to file.

Official tool: Legalia 2. Real requirements, not the marketing PDF:

Windows 10/11.
MSI from the portal.
Case file, book types, dates, «last legalised», Journal Excel, inventory PDF…
Then: Form → Check rules → Generate ZIP.
Name like LL03026BXXXXXXXX.ZIP (registry code + CIF).
That ZIP — and no other — to the portal, nature LEGALISATION, not accounts filing.

Legalia for Mac? No. Web Legalia? No. App Store? Laugh. Can you generate fingerprints on the portal by uploading Excel? In practice, no: they send you back to the program.

On Apple Silicon the implicit «official» solution is: Windows 11 ARM ISO, UTM/Parallels or an old PC, fight RDP and UAC, install Legalia, generate the ZIP, SCP it back, return to the portal on the Mac… and the native certificate dialog blocks you again at 00:20.

We generated the ZIP on a physical Windows machine (Legalia 1.5.7, Journal #4 + Inventory #4). Verified it. Shut the PC down. And when filing from the Mac, it sat waiting for a human to click the right certificate in a popup automation cannot touch.

That is the Spanish digital State: it forces you into Windows to package and Keychain witchcraft to submit.

5. Autofirma, insuit, SAML and certificate theatre

The Registrars' portal does not authenticate «like the tax agency». It uses client components (insuit / i4tservice), SAML, F5, native OS dialogs, Autofirma to sign the submission.

Headless: «invalid certificate».
Playwright with .p12: ECONNRESET on SAML.
Chrome with certificate auto-select: Access works and navigation hangs on the system dialog.
Safari: Keychain identity preference… and the popup again.

Result: an administrator with a valid FNMT representation certificate, identified company, created subscriber, correct ZIP… stopped by a macOS sheet.

It is not that «you don't know». The design assumes a human in front of a 2014 Windows box with Java and monastic patience.

6. The accountant, the Registry and parallel reality

While we fought 2025, the accountant's email broadly said they had legalised 2022–2023 and that 2024 was not.

At the Alicante Commercial Registry, however, 2024 is legalised: entry, filing, correct qualification, PDF of the entry. Filed the same day as the email that said it wasn't.

We accuse nobody of bad faith. We point at the pattern: in Spain administrative truth is a PDF that arrives months late on a different channel from the accountant's email. You live in three realities at once: the adviser's, the College's, and the entry. And you pay for all three.

7. An uncomfortable comparison (no Nordic romance)

Nobody asks for paradise. We ask for the minimum:

We ask: a browser web procedure. We get: Windows program + portal + Autofirma + subscriber.
We ask: one login = one identity. We get: certificate XOR subscriber XOR «legacy portal».
We ask: readable errors. We get: WAF HTML and «unable to determine error type».
We ask: Mac / Linux as first-class. We get: MSI + «get yourself a Windows».
We ask: a documented API. We get: JWT extraction + firewall 403.
We ask: one source of truth. We get: accountant ≠ portal ≠ entry PDF.

In Estonia you sign with ID-card or mobile-ID and file accounts in a flow designed this century. In many English-speaking countries Companies House / equivalent is ugly, but web. In Spain, in 2026, the Registrars' College sends you to install Legalia 2 as if the iPhone did not exist.

Complying with the law should not require a forensics lab.

8. Condensed timeline of the punishment (July 2026)

2025 accounts closed and balanced.
Portal filing attempt → 401 guest / non-subscriber.
Subscriber signup CIRCExxxxxx + ticket + SEPA / subscription.
Announced certificate «link» → still 401.
Complaints and follow-ups by email (22–23/07).
«Almost good» ZIP rejected for name / not-from-D2.
F5 WAF blocking extraction after a 202.
Windows + D2 → filing at last → WEBTxxxxxxxx.
Same film for the books: Windows-only Legalia, abandoned VM, physical PC, legalisation ZIP.
Back to the Mac → native certificate dialog → another night lost.
Legalisation late since 30/04/2026. The State arrives late to warn you and early to symbolically sanction with the «late» note.

Every line is company time. Every line is money. Every line is someone who could be installing solar panels instead of deciphering whether the correct radio is «legacy portal».

9. What we ask for (concretely)

Legalia and D2 on the web (or native Mac/Linux binaries). The .msi as the only path is a disgrace in 2026.
One login: representative certificate = truly linked subscriber, no ghost 401s or «it's done» emails when it isn't.
Human errors: if the WAF blocks, say «rate limit» or «session»; not F5 HTML and a front that won't name the error.
One procedure = one flow. Stop mixing accounts filing and book legalisation in the user's head with portals, radios and «legacy».
An API or at least a multiplatform local fingerprint validator, so the productive fabric is not held hostage to a mental Windows licence.

Until then, every Spanish SME with a Mac and an FNMT certificate is condemned to the same thing: digital theatre, counter-desk soul.

10. Closing

I don't hate registries. I hate the lie that this is «modern».

Modern is not putting an HTML form in front of a 1998 ritual. Modern is a sole administrator being able, from the computer they work on, to file accounts and legalise books without buying Windows, without fighting a WAF, without a three-day ticket so a already-valid certificate «counts» as a subscriber.

Spain and its European layer of mercantile procedures have turned compliance into an endurance sport. Whoever survives more support emails wins. Whoever has a company to run loses.

We will keep filing. We will comply. We will generate the ZIP. We will click Autofirma. We will pay the fee.

But we will not smile and say the electronic portal works.

What works is fear of the Registry. The software does not.

Facts based on a real 2025 accounts filing and 2025 book-legalisation case (July 2026). Subscriber IDs, ticket and filing acknowledgement numbers omitted on purpose.