Czech Republic: EET 2.0 Playground moves to an EV TLS certificate

The EET 2.0 Playground is replacing its OV TLS server certificate with an EV certificate during maintenance from 20:00 on 22 October to 06:00 on 23 October 2026. Service functionality and access do not change; vendors should check that TLS validation does not rely on certificate pinning

The Czech Financial Administration is replacing the TLS server certificate of the EET 2.0 Playground (test) environment: the current OV (Organization Validation) certificate is being replaced by an EV (Extended Validation) certificate. The change is scheduled during the maintenance window from 20:00 on October 22, 2026, to 06:00 on October 23, 2026. According to MOJE daně Portal Technical Support, service functionality and access procedures remain unchanged.

Czech Republic: EET 2.0 Playground Moves to an EV TLS Certificate

POS and fiscal software being tested against the EET 2.0 Playground connect to it over HTTPS. A change of the server certificate is normally transparent, but integrations that pin the server certificate or use a restricted trust store may fail the TLS handshake after the change. With production certificates available from November 1, 2026, and regular operation starting January 1, 2027, vendors should confirm that their TLS handling does not depend on a specific server certificate.

The Czech Financial Administration is replacing the EET 2.0 Playground's OV TLS certificate with an EV certificate during maintenance on October 22–23, 2026. Service functionality remains unchanged, but POS and fiscal software providers should verify TLS compatibility ahead of the January 2027 launch.

MOJE daně Portal Technical Support has informed connected parties that, as part of a planned security update, a new TLS certificate will be deployed in the EET 2.0 Playground environment.

The existing Organization Validation (OV) certificate will be replaced with an Extended Validation (EV) certificate. According to the notice, the update aims to strengthen organizational identity verification and align the environment with the security configuration planned for production.

The replacement is scheduled between 20:00 on October 22 and 06:00 on October 23, 2026. The notice confirms that service functionality and the way connected applications access the system will remain unchanged.

What Is the EET 2.0 Playground and Why Is It Important?
The Playground is the non-production environment of EET 2.0, the Czech Republic's electronic sales registration system.

Available to developers since July 1, 2026, it allows businesses and software providers to test communication with the Financial Administration before submitting actual sales data.

The official SOAP endpoint is:

Test transactions submitted through the Playground do not constitute legally registered sales, and the confirmation codes returned are not valid production confirmations.

The environment supports preparations for Act No. 180/2026 Coll., on Sales Registration. The Financial Administration announced its publication on October 15, 2026, while the main sales registration obligations take effect on January 1, 2027.

Preparatory activities, including obtaining production cash-register certificates, are scheduled to become available from November 1, 2026.

What Is the Difference Between OV and EV Certificates?
Both OV and EV are publicly trusted TLS server certificates used to authenticate organizations operating secured communication services.

An OV certificate confirms domain control and verifies the requesting organization. An EV certificate involves more extensive verification of the organization's legal identity under the CA/Browser Forum Guidelines for Extended Validation Certificates.

However, an EV certificate does not automatically provide stronger encryption than an OV certificate. Encryption strength depends on the TLS protocol and negotiated cryptographic algorithms.

For applications using standard certificate-chain validation against an updated public trust store, the replacement should normally be transparent.

Problems may arise where applications rely on a particular server certificate, public key or certificate chain rather than standard trust validation.

Which EET Certificates Are Affected?
It is important to distinguish between the certificates used in EET 2.0.

The TLS server certificate protects HTTPS communication between the POS application and the Financial Administration.

Separately, EET cash-register certificates issued through the CAEET certification infrastructure are used to sign electronic sales data messages. The Playground uses dedicated test certificates associated with EET CA 2 Playground.

The announced update concerns only the TLS server certificate. It does not require replacing EET signing certificates or modifying the sales message format.

Official technical documentation also confirms that HTTPS communication uses TLS 1.2 or later and does not require client certificate authentication at the transport layer.

Could the Certificate Change Affect POS Software Integration?
For correctly configured integrations, the expected technical impact is limited.

However, applications using certificate pinning or restricted trust stores may experience connection failures after replacement.

Certificate pinning means that software accepts only a particular server certificate or public key. When that certificate changes, the application may reject the HTTPS connection even if the replacement is valid.

This risk is particularly relevant for embedded POS devices, older operating systems and solutions using customized TLS configurations.

The production documentation states that server certificates may change while their required security characteristics remain consistent.

An important documentation discrepancy should also be noted. The Playground documentation, version 1.1, dated June 30, 2026, already identifies its TLS certificate as a DigiCert EV certificate, whereas the technical notice describes an existing OV certificate being replaced.

The production documentation also specifies a DigiCert EV certificate, suggesting that the Playground update aligns both environments.

The exact certificate deployed before the announced replacement has not been independently verified.

What Should POS Providers and Retailers Do?

The immediate responsibility lies mainly with POS developers and fiscal software integrators rather than retailers using existing cash-register systems.

Developers should take the following precautions:

1. Review TLS validation: Check whether applications pin a specific server certificate, public key, or intermediate certificate.
2. Verify trust stores: Ensure supported POS platforms recognize the relevant trusted DigiCert certificate authorities.
3. Test connectivity: Perform a Playground test transaction after the October 23 maintenance window and confirm successful TLS authentication.
4. Use the official DNS hostname: Avoid hardcoded IP addresses, since the Financial Administration states that Playground IP addresses may change.
5. Keep signing certificates unchanged: The replacement does not affect EET cash-register signing certificates.
6. Check production readiness: Apply equivalent TLS validation checks before the January 2027 launch.
7. The maintenance window corresponds to the regular Thursday maintenance period described in the official technical documentation.
8. Automated testing should therefore be scheduled outside this period.

Here is the link to the official guidance: https://eet.gov.cz/cs/informacni-servis

Aleksandra Vukić, Business Analyst at Fiscal Solutions

LinkedIn profile