April 10, 2023

FDA ESG Digital Certificates

If you are having trouble getting FDA’s ESG portal to work for you because of rejected digital certificates, then there there are at least a couple of alternatives.  Specifically, you can seek expert third party assistance getting your digital certificate issues resolved; and/or in the meantime while your digital certificate issues are being resolved, you can have a third party submit the eMDRs on your behalf using the third party’s ESG account.  That is a service that ComplianceAcuity can offer.

During times of complete desperation, a less viable temporary option is to, as an interim measure, submit the MDR directly to FDA’s MDR Team with an explanation that you haven’t yet been able to get your ESG submissions to work.  Be aware that FDA will reject such a submission method and you will eventually still need to submit the eMDR via the ESG. But you will at least have shown in good faith your intent to inform the agency of the reportable adverse event.

And here are some pointers for getting your FDA ESG digital certificates to work:

• The digital certificates authenticate the sender (kind of like a digital signature would).

• The sender must have two certificates: a “Public Key” certificate (file type .cer) and a “Private Key” certificate (file type .pfx).

• Together, these seem to meet the X.509 specification requirement.

• These certificates expire and will need to be renewed on a periodic basis.

• Keep your certificate files accessible at a known location on your computer.

• To see if they are not expired, click on the .cer file and a window will pop up with certificate details.

• If expired, then you will need to obtain new certificates.

• Once obtained, export the Public Key and Private Key (the .cer and .pfx files) (see https://www.fda.gov/industry/about-esg/esg-appendix-c-digital-certificates).

• Install them.

• Update the Public Key (the .cer file) needs to be uploaded into your User Portal at https://esgportal.fda.gov/.

• Once that upload is completed, then submissions should be accepted via your ESG production account.

• Note that when making an actual ESG submission, the .pfx certificate file is the one that is linked/uploaded as part of the ESG submission, not the .cer certificate file, so be sure your linking the correct one, or the ESG submission will fail.