# X509Certificate generation **URL:** \ **Category:** Signing process\ **Created:** [September 8, 2024, 9:12am UTC](https://zatca1.discourse.group/t/x509certificate-generation/2867 "2024-09-08T09:12:30Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![muzzamilnagda](https://avatars.discourse-cdn.com/v4/letter/m/3e96dc/32.png) [@muzzamilnagda](https://zatca1.discourse.group/u/muzzamilnagda)\ **Post date:** [September 8, 2024, 9:12am UTC](https://zatca1.discourse.group/t/x509certificate-generation/2867/1 "2024-09-08T09:12:30Z")
I am getting below errors in the validate xml step. Can anyone please help me? - **ategory :** SIGNATURE\_ERROR - \*\*code :\*\*invoiceSignedDataDigestValue - **message :** wrong invoice hashing - **category :** SIGNATURE\_ERROR - \*\*code :\*\*X509IssuerName - **message :** wrong X509IssuerName - **category :** XSD\_SCHEMA\_ERROR - \*\*code :\*\*SAXParseException - **message :** Schema validation failed; XML does not comply with UBL 2.1 standards in line with ZATCA specifications. ERROR: org.xml.sax.SAXParseException; lineNumber: 55; columnNumber: 98; cvc-datatype-valid.1.2.1: ‘0191CCEECAEC’ is not a valid value for ‘integer’. - **category :** SIGNATURE\_ERROR - \*\*code :\*\*NumberFormatException - **message :** For input string: “1CCEECAEC” - **category :** SIGNATURE\_ERROR - \*\*code :\*\*xadesSignedPropertiesDigestValue - **message :** wrong xadesSignedPropertiesDigestValue - **category :** SIGNATURE\_ERROR - \*\*code :\*\*signatureValue - **message :** wrong signature Value - **category :** SIGNATURE\_ERROR - \*\*code :\*\*signingCertificateDigestValue - **message :** wrong signingCertificateDigestValue ---
**Author:** ![halrashidy](https://avatars.discourse-cdn.com/v4/letter/h/3bc359/32.png) [@halrashidy](https://zatca1.discourse.group/u/halrashidy)\ **Post date:** [September 8, 2024, 9:26am UTC](https://zatca1.discourse.group/t/x509certificate-generation/2867/2 "2024-09-08T09:26:01Z")
Dear @muzzamilnagda This error happens during signing process You can follow the below steps to solve your problem: 1-After submitting the Certificate Signing Request (CSR) via the Compliance Request CSID API, you will receive a BinaryToken and a secret. 2-Decode the BinaryToken using a base64 decoder. The decoded value will be the x.509 certificate. 3-Navigate to the SDK directory: SDK/Data/Certificates/Cert.pem. 4-Replace the contents of the Cert.pem file with the x.509 certificate obtained from the decoded BinaryToken. 5-Insert the newly generated private key into the ec-secp256k1-priv-key.pem file. 6-if you use JAVA SDK, run the following command: fatoora -sign -invoice “invoice.xml”. else the .Net SDK, run the following command: fatooranet sign -invoice “invoice.xml” 7-The invoice will now be signed and can be successfully submitted during the compliance checks phase via the Compliance Invoice API. Do the same steps with production CSID to sign and submit e invoices to the reporting APIs. Thanks ---
**Author:** ![muzzamilnagda](https://avatars.discourse-cdn.com/v4/letter/m/3e96dc/32.png) [@muzzamilnagda](https://zatca1.discourse.group/u/muzzamilnagda)\ **Post date:** [September 8, 2024, 9:59am UTC](https://zatca1.discourse.group/t/x509certificate-generation/2867/3 "2024-09-08T09:59:30Z")
> [@halrashidy](#): > > fatooranet -sign -invoice “invoice.xml” I am getting below error now ![image](https://europe1.discourse-cdn.com/flex013/uploads/zatca1/original/1X/6467a78cee733c7d14f477f4fa847785a041ba00.png) ---
**Author:** ![muzzamilnagda](https://avatars.discourse-cdn.com/v4/letter/m/3e96dc/32.png) [@muzzamilnagda](https://zatca1.discourse.group/u/muzzamilnagda)\ **Post date:** [September 8, 2024, 9:59am UTC](https://zatca1.discourse.group/t/x509certificate-generation/2867/4 "2024-09-08T09:59:38Z")
Thanks @halrashidy for replying. I have one question the dedcoded certificate value is in byte do I have to encoded to put in cert.pem file or not? ---
**Author:** ![Madleen](https://avatars.discourse-cdn.com/v4/letter/m/fbc32d/32.png) [@Madleen](https://zatca1.discourse.group/u/Madleen)\ **Post date:** [September 11, 2024, 1:33pm UTC](https://zatca1.discourse.group/t/x509certificate-generation/2867/5 "2024-09-11T13:33:22Z")
Dear @muzzamilnagda , How fix it? ---
**Author:** ![AliRaza](https://avatars.discourse-cdn.com/v4/letter/a/aca169/32.png) [@AliRaza](https://zatca1.discourse.group/u/AliRaza)\ **Post date:** [October 27, 2024, 9:09am UTC](https://zatca1.discourse.group/t/x509certificate-generation/2867/6 "2024-10-27T09:09:04Z")
Dear @halrashidy i also getting this error - **category :** SIGNATURE\_ERROR - \*\*code :\*\*xadesSignedPropertiesDigestValue - **message :** wrong xadesSignedPropertiesDigestValue - **category :** SIGNATURE\_ERROR - \*\*code :\*\*X509IssuerName - **message :** wrong X509IssuerName - **category :** SIGNATURE\_ERROR - \*\*code :\*\*X509SerialNumber - **message :** wrong X509SerialNumber - **category :** SIGNATURE\_ERROR - \*\*code :\*\*signatureValue - **message :** wrong signature Value i used openssl for getting serial\_num and issue\_name using php please help me to solve this solution i am generate certificate using [https://cert4sign.com/](https://cert4sign.com/) and after that i will pass data for generate invoice then got this error ![image](https://europe1.discourse-cdn.com/flex013/uploads/zatca1/original/1X/8cc519ab849bc3725f7c39a2add6a7d140d4c051.png) ---
**Author:** ![saalotaibi](https://avatars.discourse-cdn.com/v4/letter/s/f9ae1b/32.png) [@saalotaibi](https://zatca1.discourse.group/u/saalotaibi)\ **Post date:** [October 27, 2024, 11:31am UTC](https://zatca1.discourse.group/t/x509certificate-generation/2867/7 "2024-10-27T11:31:45Z")
Dear @AliRaza We recommend you use our official E-invoicing SDK that can be found on ZATCA website. You can follow the below steps to solve your problem: 1-After submitting the Certificate Signing Request (CSR) via the Compliance Request CSID API, you will receive a BinaryToken and a secret. 2-Decode the BinaryToken using a base64 decoder. The decoded value will be the x.509 certificate. 3-Navigate to the SDK directory: SDK/Data/Certificates/Cert.pem. 4-Replace the contents of the Cert.pem file with the x.509 certificate obtained from the decoded BinaryToken. 5-Insert the newly generated private key into the ec-secp256k1-priv-key.pem file. 6-if you use JAVA SDK, run the following command: fatoora -sign -invoice “invoice.xml”. else the .Net SDK, run the following command: fatooranet sign -invoice “invoice.xml” 7-The invoice will now be signed and can be successfully submitted during the compliance checks phase via the Compliance Invoice API. Do the same steps with production CSID to sign and submit e invoices to the reporting APIs. Thanks ---
**Author:** ![AntonyRaj](https://avatars.discourse-cdn.com/v4/letter/a/f14d63/32.png) [@AntonyRaj](https://zatca1.discourse.group/u/AntonyRaj)\ **Post date:** [October 30, 2024, 12:30pm UTC](https://zatca1.discourse.group/t/x509certificate-generation/2867/8 "2024-10-30T12:30:45Z")
Dear @halrashidy We are getting the signature error only for simplified invoices. Please find the errors below from Web based validator - category : SIGNATURE\_ERROR - code : X509IssuerName - message : wrong X509IssuerName - category : SIGNATURE\_ERROR - code : X509SerialNumber - message : wrong X509SerialNumber Kindly let us know how we can resolve this. Thanks ---
**Author:** ![halrashidy](https://avatars.discourse-cdn.com/v4/letter/h/3bc359/32.png) [@halrashidy](https://zatca1.discourse.group/u/halrashidy)\ **Post date:** [November 3, 2024, 12:22pm UTC](https://zatca1.discourse.group/t/x509certificate-generation/2867/9 "2024-11-03T12:22:15Z")
Dear @AntonyRaj , please do the following steps :- 1- get your CSR config file ready with all of the required inputs, then open the command line interface in the CSR config file path and type this command to generate the CSR and private key for simulation : Fatoora -csr -csrconfig [file name] **Note** : simulation and production are independent environments, so if you want to generate a CSR for simulation please make sure to put the flag -sim 2- get your OTP from FATOORA portal that’s associated with the VAT number you have put in the CSR config file. 3- after submitting your CSR & generated OTP in the compliance CSID API, it will return you a security binarytoken, take this value and decode it using base64, and the output is the X.509 certifecate. 4- after getting your X.509 certiecate & private key, please go to the Certificates folder in SDK by following this path “SDK folder\data\Certificates” 5- after going to Certificates in the follwed path above, you will find 2 files: **first file** is cert.pem : you are requested to replace the X.509 cert value here, so copy and paste your X.509 cert. (make sure that the pasted value is already a decoded security binarytoken using base64 decoder). **second file** is ec-secp256k1-priv-key.pem: you are requested to replace the value of your generated private key here. just copy your generated private key and paste it here. 6- now you will be able to sign your B2C invoices with your certificate, by using this command: fatoora -sign -invoice [invoice file name] and this is how sucessfully you can sign your B2C invoices for compliance checks, after getting your invoices signed you can go to the next step which is compliance checks (compliance invoice API), and submit your invoices there to obtain the production CSID\Certificate. then you can validate the signed invoices using SDK with the mentioned command above. please do not hesitate to reach out if you have any further questions. thank you, ---
**Author:** ![arunmr2002](https://avatars.discourse-cdn.com/v4/letter/a/7c8e57/32.png) [@arunmr2002](https://zatca1.discourse.group/u/arunmr2002)\ **Post date:** [August 21, 2025, 9:22am UTC](https://zatca1.discourse.group/t/x509certificate-generation/2867/11 "2025-08-21T09:22:47Z")
i have also same error pls help ---
**Author:** ![arunmr2002](https://avatars.discourse-cdn.com/v4/letter/a/7c8e57/32.png) [@arunmr2002](https://zatca1.discourse.group/u/arunmr2002)\ **Post date:** [August 21, 2025, 9:23am UTC](https://zatca1.discourse.group/t/x509certificate-generation/2867/12 "2025-08-21T09:23:32Z")
Thanks for the msg..mycertificate is ok now but the private key is still showing error.I use the sdk to generate the csr and private key.Do i need to convert the key to any other format