Persistent “Invalid-CSR” error when onboarding our e-Invoicing solution In Laravel Framework (Simulation Environment)

Onboarding, renewal and revocation
1

Dear ZATCA E-Invoicing Support Team,

I am a developer working on integrating our Laravel-based e-Invoicing solution with the Fatoora platform (Phase 2 – Integration).

Taxpayer / Solution details:

  • Taxpayer Name: Hasad Elaf Co.
  • VAT / TIN: 313102075700003
  • Solution Unit / Asset Tracking Number: SME-313102075700003 (as shown in the onboarding email)
  • Functionality Map: 1100 (Standard + Simplified)
  • Country: SA
  • Industry: Trading
  • Environment: Simulation

Problem summary:
We are trying to complete the onboarding step and obtain the CSID by calling the “Compliance” API endpoint:

However, we always receive the following error response:

  • HTTP status: 400
  • errorCode: “400”
  • errorCategory: “Invalid-CSR”
  • errorMessage: “The provided Certificate Signing Request (CSR) is invalid.”

What we already tried:

  1. Generated the CSR using OpenSSL (CLI) from our Laravel backend (PHP), making sure to:
    • use secp256k1 key
    • use subject: /CN=Hasad Elaf Co. TST-313102075700003/O=Hasad Elaf Co./OU=Main Branch/C=SA
    • include the required SAN and OID fields according to the technical guidelines.
  2. Generated the CSR again using the official ZATCA Java SDK (Fatoora toolkit) with the recommended CSR configuration file.
  3. Verified the CSR locally using:
    • openssl req -text -noout -in csr.pem
    • ZATCA SDK “validate” commands when possible.
  4. Tried both Simulation and Production styles of CN/OID (PREZATCA-Code-Signing vs ZATCA-Code-Signing) as per documentation.
  5. Confirmed that the OTP is correct and not expired, and that the request is sent from a machine connected via VPN (we are located in Yemen where direct access to ZATCA domains is restricted).

Despite all these attempts, the Compliance endpoint still returns “Invalid-CSR”.

Questions / Support needed:

  1. Could you please check on your side why our CSR is being rejected for VAT 313102075700003 and Solution Unit SME-313102075700003?
  2. Are there any additional requirements for the CSR Subject or SAN fields (for example: exact format of Serial Number, Organization Unit, or Location Address) that might cause a 400 “Invalid-CSR”?
  3. Is there any difference between using OpenSSL and using the official ZATCA SDK when generating the CSR, from ZATCA’s validation point of view?
  4. Are there any known issues or limitations with the Simulation environment that could cause this repeated “Invalid-CSR” error?
  5. Once the CSR and onboarding are accepted, how should we correctly send our customers’ invoice data from our Laravel system to ZATCA (reporting/clearance APIs best practices for bulk invoices)?

Attachments / additional info:

  • Our current csr.pem (without the private key)
  • The output of openssl req -text -noout -in csr.pem (CSR readable dump)
  • Example of the exact JSON request body we send to the Compliance API
  • Example of the full HTTP response (headers + body) returned by the API

We would appreciate it if you could review our CSR and onboarding attempts and provide us with:

  • The exact reason or validation rule that is failing for our CSR
  • A working example (CSR fields and API request) that we can replicate for our taxpayer details.

Thank you very much for your support and guidance.

Best regards,
Ouis AL-Hetar
Laravel Backend Developer
Company: Hasad Elaf Co.

ouis.alhetar@gmail.com