Deployment api application on iis

SDK, web-based validator and sandbox
1

Hello all,

i have a problem that every thing works well with me on the development mode and all the invoices (simplified invoices) B2C are signed and hashed correctly using the SDK version 3.4.5 but when i publish on the iis server and take the ikvm folder and the dlls needed it always give error in signing and hashing like this

########################################################
2025-11-17 13:24:29 ERROR: ZatcaSubmitter.SubmitInvoice():
ZATCA SIGNING FAILED. Errors: [Error] Generating EInvoice Hash

[Error] Generating EInvoice Signature[Error]

Transforming Xml Result[Error]

Populating Signed Signature Properties[Error]

Populating UBL Extensions[Error]

Generating EInvoice QR Code[Error]

Finalizing Sign Document, Steps: ZATCA.EInvoice.SDK.Contracts.Models.StepResult, ZATCA.EInvoice.SDK.Contracts.Models.StepResult, ZATCA.EInvoice.SDK.Contracts.Models.StepResult, ZATCA.EInvoice.SDK.Contracts.Models.StepResult, ZATCA.EInvoice.SDK.Contracts.Models.StepResult, ZATCA.EInvoice.SDK.Contracts.Models.StepResult, ZATCA.EInvoice.SDK.Contracts.Models.StepResult, ZATCA.EInvoice.SDK.Contracts.Models.StepResult, ZATCA.EInvoice.SDK.Contracts.Models.StepResult, ZATCA.EInvoice.SDK.Contracts.Models.StepResult

#################################################################

dll1
dll1735Ă—265 54.5 KB

dll2
dll2745Ă—242 43.8 KB

dll3
dll3680Ă—482 44.1 KB

2

:check_mark: Short Answer

Your issue is not with your XML.
Your issue is filesystem permissions + missing JVM components when the ZATCA SDK (via IKVM) tries to run on IIS.

The SDK works locally because Visual Studio runs under your user account.
On IIS, it runs under IIS AppPool identity, which does not have access to:

  • the ikvm folder

  • the certificate/.pfx

  • the temp folder where IKVM writes generated classes

  • required JVM DLLs (IKVM.OpenJDK.*)

  • sometimes missing x86 vs x64 mismatch

That’s why the SDK fails at the very first step:
“Generating EInvoice Hash / Signature”

This is 100% environment-related.

:backhand_index_pointing_right: Fix Steps (What usually solves it)

1. Make sure ALL IKVM DLLs are deployed

ZATCA SDK 3.4.5 needs these:

  • IKVM.Runtime.dll

  • IKVM.OpenJDK.Core.dll

  • IKVM.OpenJDK.Security.dll

  • IKVM.OpenJDK.XML.*
    …and about 12–14 files in total.

If ONE of them is missing → signing fails.

Deploy the entire IKVM folder exactly as in your dev machine.

2. Enable permissions for the IIS AppPool

Your AppPool user (e.g., IIS APPPOOL/MyAppPool) must have:

:check_mark: Read + Write permissions on:

  • Your app folder

  • The /ikvm folder

  • The folder containing your CSID certificate

  • C:\Windows\Temp

  • Your app’s App_Data or equivalent temp folder

If the AppPool cannot write temp files → IKVM can’t initialize → signature fails.

3. Ensure platform target is x64

IKVM used in ZATCA SDK is 64-bit.

Check:

Project → Build → Platform target = x64

If you published as “AnyCPU” and IIS runs your AppPool in 32-bit mode → failure.

Check IIS:

  • Go to App Pool → Advanced Settings

  • Set Enable 32-bit Applications = False

4. Check the certificate (.pfx) path and permissions

If the SDK cannot access the PFX → it throws all the signature errors.

Make sure:

  • The PFX exists in the published folder

  • The password is correct

  • The AppPool identity has access to the folder

5. Install Visual C++ redistributables (VERY important)

IKVM depends on them.

Install both:

  • VC++ 2015–2019 x64

  • VC++ 2013 x64

Lack of these causes silent JVM initialization failures.

:police_car_light: Most common cause from your screenshots

Your screenshot shows only 6–7 DLLs.
The IKVM folder normally has 15–20 DLLs.

You’re definitely missing some of these:

IKVM.OpenJDK.Charsets.dll  
IKVM.OpenJDK.Security.dll  
IKVM.OpenJDK.Naming.dll  
IKVM.OpenJDK.Crypto.dll  
IKVM.OpenJDK.XML.API.dll  
IKVM.OpenJDK.XML.Bind.dll

If even a single one is missing → signing breaks with the exact error you got.

:check_mark: Final Checklist

Before running on IIS, confirm:

Deployment

  • All IKVM DLLs are included

  • ZATCA.Core, ZATCA.EInvoice.SDK, and dependencies included

  • PFX included

IIS

  • AppPool is x64 (32-bit disabled)

  • AppPool identity has folder permissions

  • Temp folder writable

Server

  • C++ redistributables installed

  • No antivirus blocking JVM dlls

3

But how it is working with only the 6-7 dlls of ikvm on my local machine ?
now i go through your steps without adding the ikvm remain dlls because i don’t know from where i can get them but i am still stuck at the same point

4

Hi @Seif

You can install IKVM from NuGet Package Manager.

5

Hi @Ammar

in the development mode it works well by refrencing to the ikvm dlls but it is strange thing to be stucked in the iis server now i made all the steps mentioned above and i am still getting the same errors

6

Hi,

Brother you fixed this issue?

If you still have same issue.

please contact jasimwts@gmail.com.

We need to check data folder location.

API and dll versions.

7

i sent you an email to contact

8

Hello, @Seif

I hope you are doing well.

I am experiencing the same issue on my system. In the local development environment, everything works correctly; however, after publishing the application to the server, it fails silently.

I have added the IKVM package using the NuGet Package Manager. While the package is present in the published folder, I am unable to locate the IKVM.OpenJDK.*.dll files. I also checked the SDK folders, but the required IKVM.OpenJDK assemblies do not seem to be available there either.

If you could kindly share how you managed to resolve this issue, or if there are any additional steps we need to follow to ensure these DLLs are included during deployment, we would greatly appreciate your help.

Thank you in advance for your time and support.

Regards,
Tarun

9

you have to add folder data from api to your project anf change cert and private key with yours and do all steps above in answer of **SP_VoM**Verified Solution Provider​:check_mark: