# Invalid CSR for simulation **URL:** \ **Category:** FATOORA portal and Simulation portal\ **Created:** [March 1, 2025, 6:43am UTC](https://zatca1.discourse.group/t/invalid-csr-for-simulation/6098 "2025-03-01T06:43:05Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![naval](https://dub1.discourse-cdn.com/flex013/user_avatar/zatca1.discourse.group/naval/32/891_2.png) [@naval](https://zatca1.discourse.group/u/naval)\ **Post date:** [March 1, 2025, 6:43am UTC](https://zatca1.discourse.group/t/invalid-csr-for-simulation/6098/1 "2025-03-01T06:43:05Z")
I am following all the steps for generating Base64 CSR using openssl. I have tried making many changes to the car\_config.txt and still get Invalid CSR. oid\_section = OIDs [OIDs] certificateTemplateName = 1.3.6.1.4.1.311.20.2 [req] default\_bits = 2048 emailAddress = nkishore@xxxxx.xxx req\_extensions = v3\_req prompt = no default\_md = sha256 distinguished\_name = dn [dn] C = SA OU = Riyadh O = My Organization CN = PREZATCA-Code-Signing [v3\_req] basicConstraints = CA:FALSE keyUsage = digitalSignature, nonRepudiation, keyEncipherment subjectAltName = dirName:alt\_names certificateTemplateName = ASN1:PRINTABLESTRING:PREZATCA-Code-Signing [alt\_names] SN = 1-TenderCare|2-Model123|3-ed22f1d8e6a211189b58d9a8f11e445f UID = 310000000000003 title = 0100 registeredAddress = Riyadh businessCategory = Healthcare I have used actual organization name and TRN but I still keep getting Invalid CSR. What am I doing wrong? ---
**Author:** ![idaoud](https://avatars.discourse-cdn.com/v4/letter/i/f9ae1b/32.png) [@idaoud](https://zatca1.discourse.group/u/idaoud)\ **Post date:** [March 1, 2025, 10:20am UTC](https://zatca1.discourse.group/t/invalid-csr-for-simulation/6098/2 "2025-03-01T10:20:30Z")
Dear @naval Thanks for reaching out, Welcome to our community. To provide comprehensive support as usual, can I kindly ask you to mention all the steps that you followed from the beginning, Additionally, Providing screenshots will be more helpful for our investigation. Thanks, Ibrahem Daoud. ---
**Author:** ![naval](https://dub1.discourse-cdn.com/flex013/user_avatar/zatca1.discourse.group/naval/32/891_2.png) [@naval](https://zatca1.discourse.group/u/naval)\ **Post date:** [March 1, 2025, 12:25pm UTC](https://zatca1.discourse.group/t/invalid-csr-for-simulation/6098/3 "2025-03-01T12:25:27Z")
Dear Ibrahem, Thank you so much for your prompt response. I used the attached csr\_config.txt and the attached Powershell script (from Microsoft). As this did not work, I generated manually, using the following commands: - openssl ecparam -name secp256k1 -genkey -noout -out privatekey.pem Alternative - openssl genpkey -algorithm RSA -pkeyopt rsa\_keygen\_bits:2048 -out privatekey.pem Then - openssl ec -in privatekey.pem -pubout -conv\_form compressed -out publickey.pem - openssl req -new -sha256 -key privatekey.pem -extensions v3\_req -config csr\_config.txt -out taxpayer.csr - openssl base64 -in taxpayer.csr -out taxpayerCSRbase64Encoded.txt I then used the base64 encoded text in Swagger on the dev portal and received error: can’t parse json I posted through Postman, setting all the headers including v2 and the OTP. The error was: Invalid CSR. Your assistance to resolve this is greatly appreciated. Thank you and best regards, Naval From “Ibrahem Daoud via Fatoora Developer Community” \<[notifications@zatca1.discoursemail.com](mailto:notifications@zatca1.discoursemail.com)\> To “Dr. N. Kishore” \<[nkishore@tendercare.me](mailto:nkishore@tendercare.me)\> Date 01/03/2025 2:30:39 PM Subject [Fatoora Developer Community] [FATOORA portal and Simulation portal] Invalid CSR for simulation (Attachment zatca\_script.ps1 is missing) (Attachment csr\_config.txt is missing) ---
**Author:** ![naval](https://dub1.discourse-cdn.com/flex013/user_avatar/zatca1.discourse.group/naval/32/891_2.png) [@naval](https://zatca1.discourse.group/u/naval)\ **Post date:** [March 1, 2025, 12:34pm UTC](https://zatca1.discourse.group/t/invalid-csr-for-simulation/6098/4 "2025-03-01T12:34:24Z")
Dear Ibrahem, Thank you so much for your prompt response. I used the csr\_config.txt I posted previously and the Powershell script from Microsoft The powershell script gave Invalid CSR, so I generated manually, using the following commands: - openssl ecparam -name secp256k1 -genkey -noout -out privatekey.pem Alternative - openssl genpkey -algorithm RSA -pkeyopt rsa\_keygen\_bits:2048 -out privatekey.pem Then - openssl ec -in privatekey.pem -pubout -conv\_form compressed -out publickey.pem - openssl req -new -sha256 -key privatekey.pem -extensions v3\_req -config csr\_config.txt -out taxpayer.csr - openssl base64 -in taxpayer.csr -out taxpayerCSRbase64Encoded.txt I then used the base64 encoded text in Swagger on the dev portal and received error: _can’t parse json_ I posted through Postman, setting all the headers including v2 and the OTP. The error was: _Invalid CSR_. Your assistance to resolve this is greatly appreciated. Thank you and best regards, Naval ---
**Author:** ![idaoud](https://avatars.discourse-cdn.com/v4/letter/i/f9ae1b/32.png) [@idaoud](https://zatca1.discourse.group/u/idaoud)\ **Post date:** [March 3, 2025, 6:09am UTC](https://zatca1.discourse.group/t/invalid-csr-for-simulation/6098/5 "2025-03-03T06:09:43Z")
Morning @naval I hope you are doing well, Please try to use the below commands and let me know if it’s works: 1- Create private key openssl ecparam -name secp256k1 -genkey -noout -out ec-secp256k1-priv-key.pem 2- Create public key openssl ec -in ec-secp256k1-priv-key.pem -pubout \> ec-secp256k1-pub-key.pem 3- Create CSR openssl req -new -sha256 -key ec-secp256k1-priv-key.pem -extensions v3\_req -config config.cnf -out my.csr Thanks, Ibrahem Daoud. ---
**Author:** ![naval](https://dub1.discourse-cdn.com/flex013/user_avatar/zatca1.discourse.group/naval/32/891_2.png) [@naval](https://zatca1.discourse.group/u/naval)\ **Post date:** [March 3, 2025, 7:17am UTC](https://zatca1.discourse.group/t/invalid-csr-for-simulation/6098/6 "2025-03-03T07:17:07Z")
Good morning and thank you for your support. I had used secp256k1 earlier and have done so again, following the steps given by you. Do I need to encode the CSR to base64? My results are as below: **Without base64 encoding:** - Swagger: can’t parse json - Postman: Invalid CSR: PKCS10csr is invalid or empty **With base64 encoding** (openssl base64 -in my.csr -out myCSRbase64Encoded.txt — then remove all line breaks and spaces) - Swagger: can’t parse json - Postman: The provided Certificate Signing Request (CSR) is invalid. For Swagger I am using the dev portal and for Postman I am using the urls: **gw-fatoora.zatca.gov.sa/e-invoicing/core/compliance** and **gw-fatoora.zatca.gov.sa/e-invoicing/developer-portal/compliance** -----BEGIN CERTIFICATE REQUEST—— MIICMjCCAdgCAQAwYzELMAkGA1UEBhMCU0ExDzANBgNVBAsMBlJpeWFkaDEjMCEG A1UECgwaUmFuYSBTaGFoYWIgTWVkaWNhbCBDZW50ZXIxHjAcBgNVBAMMFVBSRVpB VENBLUNvZGUtU2lnbmluZzBWMBAGByqGSM49AgEGBSuBBAAKA0IABLA9bOdPte0y L2++jLhjBKnZPG7N58FAllg8y7+9WqJeb05s4YKLYz13KRNNUR0+WzykOLS/HgyU BgKFUGN2kyKgggEUMIIBEAYJKoZIhvcNAQkOMYIBATCB/jAJBgNVHRMEAjAAMAsG A1UdDwQEAwIF4DCBvQYDVR0RBIG1MIGypIGvMIGsMUMwQQYDVQQEDDoxLVRlbmRl ckNhcmV8Mi1Nb2RlbDEyM3wzLWVkMjJmMWQ4ZTZhMjExMTg5YjU4ZDlhOGYxMWU0 NDVmMR8wHQYKCZImiZPyLGQBAQwPMzEwMDUwMTkwMjAwMDAzMQ0wCwYDVQQMDAQw MTAwMSAwHgYDVQQaDBdEZXJtYXRpcXVlLCBSaXlhZGgsIEtTQTETMBEGA1UEDwwK SGVhbHRoY2FyZTAkBgkrBgEEAYI3FAIEFxMVUFJFWkFUQ0EtQ29kZS1TaWduaW5n MAoGCCqGSM49BAMCA0gAMEUCIQDHu6ve1n/SniG9ZaeFeWWsIhvonxdoCO5BwQqi bt2Y8AIgN5rlwCHz1bV4jfVULhIRdN6jI2Kanjd1T/neZvCI/20= -----END CERTIFICATE REQUEST----- Encoded: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0KTUlJQ01qQ0NBZGdDQVFBd1l6RUxNQWtHQTFVRUJoTUNVMEV4RHpBTkJnTlZCQXNNQmxKcGVXRmthREVqTUNFRwpBMVVFQ2d3YVVtRnVZU0JUYUdGb1lXSWdUV1ZrYVdOaGJDQkRaVzUwWlhJeEhqQWNCZ05WQkFNTUZWQlNSVnBCClZFTkJMVU52WkdVdFUybG5ibWx1WnpCV01CQUdCeXFHU000OUFnRUdCU3VCQkFBS0EwSUFCTEE5Yk9kUHRlMHkKTDIrK2pMaGpCS25aUEc3TjU4RkFsbGc4eTcrOVdxSmViMDVzNFlLTFl6MTNLUk5OVVIwK1d6eWtPTFMvSGd5VQpCZ0tGVUdOMmt5S2dnZ0VVTUlJQkVBWUpLb1pJaHZjTkFRa09NWUlCQVRDQi9qQUpCZ05WSFJNRUFqQUFNQXNHCkExVWREd1FFQXdJRjREQ0J2UVlEVlIwUkJJRzFNSUd5cElHdk1JR3NNVU13UVFZRFZRUUVERG94TFZSbGJtUmwKY2tOaGNtVjhNaTFOYjJSbGJERXlNM3d6TFdWa01qSm1NV1E0WlRaaE1qRXhNVGc1WWpVNFpEbGhPR1l4TVdVMApORFZtTVI4d0hRWUtDWkltaVpQeUxHUUJBUXdQTXpFd01EVXdNVGt3TWpBd01EQXpNUTB3Q3dZRFZRUU1EQVF3Ck1UQXdNU0F3SGdZRFZRUWFEQmRFWlhKdFlYUnBjWFZsTENCU2FYbGhaR2dzSUV0VFFURVRNQkVHQTFVRUR3d0sKU0dWaGJIUm9ZMkZ5WlRBa0Jna3JCZ0VFQVlJM0ZBSUVGeE1WVUZKRldrRlVRMEV0UTI5a1pTMVRhV2R1YVc1bgpNQW9HQ0NxR1NNNDlCQU1DQTBnQU1FVUNJUURIdTZ2ZTFuL1NuaUc5WmFlRmVXV3NJaHZvbnhkb0NPNUJ3UXFpCmJ0Mlk4QUlnTjVybHdDSHoxYlY0amZWVUxoSVJkTjZqSTJLYW5qZDFUL25lWnZDSS8yMD0KLS0tLS1FTkQgQ0VSVElGSUNBVEUgUkVRVUVTVC0tLS0tCg== Your help is greatly appreciated. Best regards, Naval ---
**Author:** ![idaoud](https://avatars.discourse-cdn.com/v4/letter/i/f9ae1b/32.png) [@idaoud](https://zatca1.discourse.group/u/idaoud)\ **Post date:** [March 3, 2025, 7:24am UTC](https://zatca1.discourse.group/t/invalid-csr-for-simulation/6098/7 "2025-03-03T07:24:08Z")
Dear @naval Can I kindly ask you to share your full concerns to our technical support team via below mail, to schedule one to one meeting if needed. SP mail: [sp\_support@zatca.gov.sa](mailto:sp_support@zatca.gov.sa) Thanks, Ibrahme Daoud. ---
**Author:** ![bahaeddine](https://avatars.discourse-cdn.com/v4/letter/b/3ec8ea/32.png) [@bahaeddine](https://zatca1.discourse.group/u/bahaeddine)\ **Post date:** [March 3, 2025, 7:43am UTC](https://zatca1.discourse.group/t/invalid-csr-for-simulation/6098/8 "2025-03-03T07:43:38Z")
@naval change default\_md = sha256 to (default\_md = sha 256 ) add (req\_extensions = req\_ext) below it . add ( [req\_ext] ) before (subjectAltName = dirName:alt\_names) and then generate csr again . ---
**Author:** ![naval](https://dub1.discourse-cdn.com/flex013/user_avatar/zatca1.discourse.group/naval/32/891_2.png) [@naval](https://zatca1.discourse.group/u/naval)\ **Post date:** [March 3, 2025, 8:50am UTC](https://zatca1.discourse.group/t/invalid-csr-for-simulation/6098/9 "2025-03-03T08:50:04Z")
Thanks for reaching out. I made the changes you suggested: _[req]_ _default\_bits = 2048_ _default\_md = sha 256_ _req\_extensions = req\_ext_ _prompt = no_ _distinguished\_name = dn_ _req\_extensions = v3\_req_ _[v3\_req]_ _basicConstraints = CA:FALSE_ _keyUsage = digitalSignature, nonRepudiation, keyEncipherment_ _[req\_ext]_ _subjectAltName = dirName:alt\_names_ _certificateTemplateName = ASN1:PRINTABLESTRING:PREZATCA-Code-Signing_ Then I generated CSR again, encoded to base64 with openssl base64 -in my.csr -out myCSRbase64Encoded.txt, removed the line-breaks and spaces and am still getting Invalid CSR when I submit. I really can’t figure out what is wrong. Any help would be gratefully appreciated. Thanks. From “Baha Eddine via Fatoora Developer Community” \<[notifications@zatca1.discoursemail.com](mailto:notifications@zatca1.discoursemail.com)\> To “Dr. N. Kishore” \<[nkishore@tendercare.me](mailto:nkishore@tendercare.me)\> Date 03/03/2025 11:53:43 AM Subject [Fatoora Developer Community] [FATOORA portal and Simulation portal] Invalid CSR for simulation ---
**Author:** ![bahaeddine](https://avatars.discourse-cdn.com/v4/letter/b/3ec8ea/32.png) [@bahaeddine](https://zatca1.discourse.group/u/bahaeddine)\ **Post date:** [March 3, 2025, 9:04am UTC](https://zatca1.discourse.group/t/invalid-csr-for-simulation/6098/10 "2025-03-03T09:04:31Z")
@naval copy this config file . oid\_section = OIDs [OIDs] certificateTemplateName = 1.3.6.1.4.1.311.20.2 [req] default\_bits = 2048 emailAddress = {email} req\_extensions = v3\_req x509\_extensions = v3\_ca prompt = no default\_md = sha 256 req\_extensions = req\_ext distinguished\_name = dn [dn] C={c} OU={ou} O={o} CN={cn} [v3\_req] basicConstraints = CA:FALSE keyUsage = digitalSignature, nonRepudiation, keyEncipherment [req\_ext] certificateTemplateName = {certificate\_template} subjectAltName = dirName:alt\_names [alt\_names] SN={sn} UID={uid} title={title} registeredAddress= {address} businessCategory={category} ---
**Author:** ![naval](https://dub1.discourse-cdn.com/flex013/user_avatar/zatca1.discourse.group/naval/32/891_2.png) [@naval](https://zatca1.discourse.group/u/naval)\ **Post date:** [March 3, 2025, 10:25am UTC](https://zatca1.discourse.group/t/invalid-csr-for-simulation/6098/11 "2025-03-03T10:25:02Z")
Thank you so much. It worked!