Getting error for compliance check in Live but not for Simulation

General
1

I am getting the below response during on-boarding compliance check for live APIs

{
“validationResults”: {
“infoMessages”: [
{
“type”: “INFO”,
“code”: “XSD_ZATCA_VALID”,
“category”: “XSD validation”,
“message”: “Complied with UBL 2.1 standards in line with ZATCA specifications”,
“status”: “PASS”
}
],
“warningMessages”: [
{
“type”: “WARNING”,
“code”: “invalid-signing-certificate”,
“category”: “CERTIFICATE_ERRORS”,
“message”: “X509Certificate (CCSID / PCSID) used for signing is not valid certificate (CCSID / PCSID) for this VAT Registration Number.”,
“status”: “WARNING”
}
],
“errorMessages”: [
{
“type”: “ERROR”,
“code”: “invalid-digital-signature”,
“category”: “SIGNATURE_ERRORS”,
“message”: “Invalid digital signature”,
“status”: “ERROR”
}
],
“status”: “ERROR”
},
“reportingStatus”: “NOT_REPORTED”,
“clearanceStatus”: null,
“qrSellertStatus”: null,
“qrBuyertStatus”: null
}

But the same is working perfectly in Simulation.

Why would this happen ? There is no difference in the request for both.

2

@shiyaf_texo you may be using Simulation Certificate on Production. You need to make sure that invoice is signed using the Production CSID from Production Environment (not PCSID generated on Simulation Environment or CCSIDs or any other CSIDs).

3

Dear @shiyaf_texol

Kindly be informed that the system works as expected. No need to share any further posts for the same queries. Additionally, your elaboration to provide the requested information on this post Clarification Regarding “invalid-digital-signature” signed with different private key Warning - Signing process - Fatoora Developer Community is highly recommended to allow our technical team to provide the usual comprehensive support.

Thanks,
Ibrahem Daoud.

4

This usually happens when the certificate used in Simulation is not the same one required for Production (Live) onboarding.
Although the XML and signing process may be identical, the certificates are not interchangeable between Simulation and Live environments.

:check_mark: Why Simulation Works but Live Fails

Simulation allows you to use simulation-issued CSIDs/PCSID-hosted keys, and it does not validate them against your actual VAT (TIN) registration.
Live mode, however:

  • Verifies that the signing certificate (CCSID/PCSID) is issued for your real VAT number.

  • Validates the digital signature against the certificate installed on your production device.

  • Enforces strict certificate chain requirements.

Because of that, any of the below will trigger:

invalid-signing-certificate
invalid-digital-signature

:magnifying_glass_tilted_left: Common Causes

  1. Using the Simulation CSID/Certificate in Production
    You must generate a new CSR from your production device and activate it using the Live onboarding APIs.

  2. CSR created with wrong TIN or Organization Identifier
    The OrganizationIdentifier in the CSR must match your VAT registration number in the exact required format:

    SA<TIN>

  3. Wrong private key / certificate pair being used for signing
    If the signature is created using a different private key than the one linked to the activated CSID, you’ll get invalid-digital-signature.

  4. Certificate not properly installed on the device
    ZATCA checks device identity. A mismatch between the machine CSR and the signing certificate causes failure.

:test_tube: Quick Checks You Can Do

  • Confirm you activated a Live device, not simulation.

  • Verify the certificate subject contains your VAT number.

  • Re-sign the invoice using the newly activated Live certificate’s private key.

  • Inspect the DigestValue and SignatureValue to ensure they correspond to the same keypair.

:white_check_mark: Recommended Fix

Regenerate a new CSR from your production environment → Activate it via the Live “Onboarding Compliance” → Use the returned CCSID/PCSID certificate for all Live invoice signing.

5

We are using Production CSID only, everything was working perfectly till last week.
This is after some update from Zatca side.

For understanding whether the issue is our system or not, atleast we should be able to get the same error in Simulation or Development. But both are still working.

6

anyone was able to resolve the issue?

7

Also, this issue is only for Simplified Invoices and not Standard in Production

8

same case here my friend

9

We are facing the same issue. When sending an onboarding B2C invoice, we receive the error code “invalid-digital-signature.”

10

The issue has now been resolved. Please try again and let us know if you experience any issue.

11

The issue has been resolved. Please try again and inform us if you experience any further issues.