1.2. CSD or Digital Seal Certificate
The Digital Signature Certificate (CSD) consists of a public key, a private key, and its corresponding password. However, it is crucial to understand that the CSD is different from, but not entirely independent of, the Electronic Signature (FIEL) (the SAT requires a FIEL to process a CSD), but they cannot be used for the same purpose. Their handling must be differentiated, and they must be used correctly for the corresponding procedures.
The Digital Seal Certificate (CSD) is issued by the SAT (Mexican Tax Administration Service) specifically for generating Digital Tax Receipts (CFD). Through this certificate, taxpayers can electronically seal (sign) the original chain of e-document (such as electronic invoices or others) issued at each of their branches. This ensures the identification of the origin of the e-document, along with its uniqueness and other characteristics of digital certificates (integrity, non-repudiation, authenticity, and confidentiality). Taxpayers can choose to request a digital seal for each branch, establishment, or location where they issue digital tax receipts.
A CSD consists of:
- “.cer” file (Public key).
- “.key”file (Public key).
- Private Key Password.
- Additionally, and in case of needing to cancel, the Revocation Password.
The extension of the CSD (Digital Seal Certificate) issued by the SAT is: ".cer", which in turn is of type X509 DER. Below is an example of a command using openssl to view the contents of the CSD certificate encoded in base64:
When Solución Factible® generates an electronic invoice (or any other CFDI), a CSD is used to electronically "sign" the e-document. The two files belonging to the CSD, the ".cer" and the ".key" + the password are used together to electronically sign the invoice.
The original chain of issued invoices is electronically sealed to guarantee their origin, uniqueness, and other properties inherited from the certificates.
2048-bit bits
During January 2013, the SAT (Mexican Tax Administration Service) granted taxpayers 1024 and 2048 bit certificates. Solución Factible® will be able to stamp e-document sealed with these certificates, provided that the XML structure is correct.
1.2.1. Differentiating a CSD from a FIEL
One way to identify the certificate type is to try logging into the SAT portal. If you can log in, it's a FIEL (Electronic Signature); otherwise, it's likely a CSD (Digital Signature Certificate). It's also possible that you won't be granted access because the password is incorrect or because you tried using the ".key" file (FIEL) mixed with the ".cer" file (CSD).
Another option is to extract the "subject" from the certificate and look at the "OU" (organization unit) value; if it has a value, then it is a CSD.
Example command with openssl showing this behavior:
Result:
In the previous example, the string is found: /OU=SucursalAVL, therefore, it is a CSD.
1.2.2. List of Obligated Taxpayers (LCO)
The LCO is a list issued by the SAT that, in short, contains the RFC and CSD issued, generally, up to the day before its publication.
The list contains:
- RFC.
- CSD serial number.
- CSD effective date.
- CSD expiry date.
- CSD Status (Active, Revoked or Expired).
- Validity of tax obligations.
At Solución Factible® as a PAC (Authorized Certification Provider), we consult the tax status and the status of the CSD (Digital Signature Certificate) of each taxpayer who wants to issue invoices with us. Before issuing a CFDI (e-document), we search for the taxpayer in the List of Obligated Taxpayers (LCO), as well as the CSD with which they signed the receipt. If it is found, we then verify the status of the certificate and the validity of the obligations. The steps to follow are detailed below:
- If the document does not meet the tax requirements, the stamping process is rejected.
- If it meets the tax requirements, the certificate's status is checked. If it is active, the stamping process is accepted.
- If it is revoked or expired, the certificate's expiration date is compared to the CFDI issuance date.
- If the issuance date is earlier than the invoice is expiration date, the document is stamped; if it is later, it is rejected.
Tool
CSD Validator
This tool will upload a Certificate and check if it is a valid Certificate, CSD, if it was issued by the SAT or will display an error message if any problem is found.
Out of reach.
The validations that do not apply because they are outside the scope due to technical or operational restrictions are:
- Validation against LCO list. Due to confidentiality restrictions of SAT information, it is not possible to verify the status of Revoked CSD and the applicability of border taxes.
- LRFC list validation. Due to SAT information confidentiality restrictions, it is not possible to validate that the RFC, name, and postal code of the issuer and recipient of the receipt correspond to those registered in the LRFC.
