Expired Alloggiati Web certificate: logging in today

If you have been running a property for a few years, you will likely remember the digital certificate that had to be installed in your browser and renewed every two years. Today, accessing Alloggiati Web works differently, and an expired certificate is no longer a problem you need to worry about.

How it used to work

For years, accessing the Italian State Police portal required a personal digital certificate. You would download it from the portal using the credentials provided by the local police headquarters (Questura), install it in your browser, and it would remain valid for two years. The FAQs from various police offices explained how to renew it ten days before it expired, which browsers to use, and what to do if your antivirus blocked the installation. Many guides still found online today describe that exact, outdated process.

The change came with the new version of the service. A notice from the Catanzaro Police Headquarters, published on 19 January 2022, announced a new security and access mechanism that no longer requires a digital certificate. It is now based on a set of codes provided to the user. It also asked those with an active certificate to switch to the new system independently before their current one expired. Therefore, any instructions regarding certificate renewal refer to a portal that no longer exists.

How to log in today

The current User Manual describes a two-step login process. From the portal's homepage, you select the "Access" menu, then "Codes" and "Work Area (Codes)", and enter your username and password. At that point, the system displays a small keypad and asks for specific digits from your Code Card. This is a personal card containing sixteen groups of four numbers, and each time you log in, it randomly asks for a specific digit from a specific group.

The mechanism is similar to what banks have used for some time: something you know and something you possess. The password alone is not enough, and neither is the card. For this reason, you should treat your Code Card like your house keys. Do not photograph it, do not send it via chat, and do not leave it hanging near your computer. After three failed attempts with the codes, the portal reverts to the username and password screen.

If your certificate has expired and you never switched to the codes

This happens to those who used the portal rarely or who delegated the submissions to someone else for years, and now find themselves with an expired certificate and no Code Card. The solution is not to renew the certificate, but to obtain the codes.

The portal offers a "Recover credentials" function in the "Support" menu, which allows you to retrieve four items: access codes, the Code Card, the PUK, and the password. Recovery only works if you have at least two of the items on the list, according to specific combinations. The Code Card and access codes are recovered with the password and PUK; the password with the Code Card and PUK; and the PUK with the password and Code Card. If you do not have at least two of these, you must contact your local police headquarters, which will explain how to proceed with their specific form.

In the meantime, the Italian legal obligation to report guests remains. Official guidelines allow for alternative channels, such as certified email (PEC), only when the portal is down due to technical issues. If you are missing credentials, it is best to ask your local police headquarters immediately how to handle ongoing arrivals.

Personal credentials, even when the business changes hands

Alloggiati Web credentials are tied to the person managing the property and their specific authorization. The FAQs from the Siena Police Headquarters explain that if you take over a business, you cannot use the previous manager's credentials. You must request a new authorization in your own name, and the same applies when the company managing the property changes. If you close the business, you must return the authorization to the police, who will then deactivate the credentials. Outside of these cases, the authorization does not expire and does not need to be renewed annually.

Being "personal" does not mean they must stay exclusively in the owner's hands. The Ministry of the Interior decree of 16 September 2021 allows you to entrust them to an identified person who is tasked with transmitting the data, provided the owner gives them the necessary instructions. This is the basis upon which a trusted collaborator can handle submissions on behalf of the host.

The WS Key, the code for software

Those who submit guest data using software rather than a browser will encounter a third element. Programs connect to the portal's web service using the Web Service Key, also known as WSKEY, which is generated from the portal itself. You open the menu linked to your username in the top right, select "Web Service Key", and press "Generate New Code".

The manual sets out two rules to keep in mind. You can only generate one new code per day, so it is worth copying it carefully the first time. Furthermore, every time you change your portal password, you need a new key, because the old one stops working along with the password. This is the root cause of many automatic submissions that suddenly stop working weeks after a password change made for an entirely different reason.

How it works with Roraima

Roraima is one of the programs that connects to the Italian State Police web service. In the panel, under "Compliance Italia", the owner enters their property's username, password, and WS Key. If you manage multiple properties, each can have its own credentials. The credentials are stored in an encrypted format, and the Code Card is not needed because the connection between programs is handled by the key.

Before moving to actual submissions, you can test the connection using the "Verify connection" button in test mode, which checks the credentials without sending any guest data. When the portal password changes, you simply generate a new WS Key and update it in the same place. If a key is no longer valid, the submission will stop, and the owner will see this in the panel, with the option to retry once the key is updated, as explained in the article Alloggiati Web submission failed: how to retry.

The page Guest documents and legal filings explains the rest of the process, from the data the guest enters from home to the receipt.

Frequently Asked Questions

My Alloggiati Web digital certificate has expired: what should I do?

Nothing regarding the certificate, as it is no longer used with the new version of the service. You log in with your username, password, and Code Card. If you do not have the card yet, you can recover it using the "Recover credentials" function on the portal or request it from your local police headquarters.

I lost my Code Card: how do I recover it?

Use the "Recover credentials" function in the "Support" menu of the portal, provided you still have your password and PUK. If you are missing these two elements, you must contact the police headquarters.

Is the WS Key the same as the password?

No. The password is used to log into the portal via a browser, while the WS Key is used by programs that send guest data automatically. It is generated from the portal, only once per day, and must be regenerated every time you change your password.

How do I obtain Alloggiati Web credentials?

You must request them from the police headquarters in the province where the property is located, using the form and method specified by that office. Contact details and instructions can be found in the "Contacts" section of the portal or on the police headquarters' website. Processing times vary by province, so it is best to request them before you open.