Direct Answer / Quick Summary:

A Production Cryptographic Stamp Identifier (PCSID) issued by Saudi Arabia's Zakat, Tax and Customs Authority (ZATCA) under Phase 2 is an X.509 v3 digital certificate valid for 5 years from its issuance date.

Proactive Renewal (Before Expiration - Recommended): If your PCSID is still active, you do not need a new OTP* from the Fatoora Portal. Your ERP can programmatically rotate certificates by sending an HTTP PATCH request to the /production/csids endpoint using your existing active PCSID credentials (binarySecurityToken:secret) for HTTP Basic Authentication alongside a freshly generated CSR.

Emergency Renewal (After Expiration): If your PCSID has already expired, your ERP can no longer authenticate against ZATCA's API. You must log into the Fatoora Portal via Nafath/ERAD, revoke or select the expired device, generate a fresh 6-digit One-Time Password (OTP)*, and execute the full re-onboarding cycle (Compliance CSID → Sample Invoices → Production CSID).

Business Impact of Expiration: The moment a PCSID expires, all real-time B2B clearances are blocked with `HTTP 401 Unauthorized`. Corporate buyers cannot legally deduct input VAT* on invoices issued during a certificate lapse.

The Legal and Cryptographic Context of CSID Expiration

Under the Executive Regulations for Value Added Tax and the technical provisions of Royal Decree No. M/113, every electronic tax invoice generated in Saudi Arabia must carry cryptographic proof of authenticity.

The Production CSID embeds your company's Tax Registration Number (TRN), branch location, and unique Electronic Generation Solution (EGS) serial number. ZATCA assigns a strict 5-year cryptographic validity window to comply with international Public Key Infrastructure (PKI) standards. Over 5 years, underlying cryptographic elliptic curve parameters can degrade, and hardware changes require scheduled re-authentication.

Day 0Fatoora Live

Initial Onboarding

EGS generates secp256k1 keypair; ZATCA signs CSR; 5-year Production CSID issued

Years 1 to 4Immutable Ledger

Live Operations

EGS signs B2B/B2C transactions daily; hash chain increments perpetually

Day 1765 (60 Days Prior)Zero-Downtime API

Proactive Renewal Window

ERP automated alert triggers CSR generation; calls PATCH /production/csids

Day 1825Service Halt

Expiration Cutoff

If unrenewed, ZATCA Trust Sub-CA revokes clearance authority; API blocks live transactions

Two Distinct Renewal Pathways: Pre-Expiration vs Post-Expiration

The exact technical workflow required to renew your CSID depends entirely on whether the certificate has already expired:

Technical ParameterPathway A: Proactive Renewal (Active PCSID)Pathway B: Emergency Renewal (Expired PCSID)
Certificate StatusActive / Valid (Recommended: 30–60 days before expiry)Expired / Terminated
Fatoora Portal OTP Required?NO. Zero manual portal intervention required.YES. Authorized representative must generate 6-digit OTP.
API Method & EndpointPATCH /e-invoicing/core/production/csidsPOST /compliance → PATCH /production/csids
Authentication SchemeHTTP Basic Auth with existing active PCSID + secret.Initial handshake via 6-digit OTP in HTTP header.
Compliance Invoicing CheckBypassed. Direct production certificate rotation.Mandatory. Must re-run the 6 compliance test invoices.
ERP Billing Downtime0 Seconds (Zero-Downtime Hot Swap).Significant (Hours or Days of manual admin).

Pathway A: Step-by-Step Proactive Renewal (Before Expiration)

Proactive renewal is designed for enterprise ERPs (SAP, Oracle, Odoo, custom software) that maintain scheduled token rotation jobs.

Step 1: Generate a Fresh Keypair and CSR

Using OpenSSL, generate a new secp256k1 private key and CSR. Ensure the Subject fields (TRN, EGS serial number, branch location, invoice capability flag) match the active device:

bash|Technical Specification / Reference
Verified Schema
# 1. Generate a new private key
openssl ecparam -name secp256k1 -genkey -noout -out new_private_key.pem

# 2. Generate the CSR using your existing configuration file
openssl req -new -sha256 -key new_private_key.pem -extensions v3_req -config egs_config.cnf -out new_renewal.csr

# 3. Base64 encode the new CSR into a clean string
cat new_renewal.csr | base64 -w 0 > new_csr_base64.txt

Step 2: Call the ZATCA Renewal API (PATCH /production/csids)

Construct an HTTP PATCH request to the core production gateway. Authenticate using your current, active Production CSID credentials:

http|Technical Specification / Reference
Verified Schema
PATCH /e-invoicing/core/production/csids HTTP/1.1
Host: gw-fatoora.zatca.gov.sa
Accept-Language: en
Accept-Version: V2
Content-Type: application/json
Authorization: Basic <Base64_Encoded(Old_BinarySecurityToken:Old_Secret)>

Request JSON Body:

json|Technical Specification / Reference
Verified Schema
{
  "csr": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0KTUlJQmZ6Q0NBVU1DQVFBd1ZE...[NEW_CSR_BASE64]..."
}

Step 3: Handle the API Response & Execute Atomic ERP Swap

Upon verification, ZATCA returns HTTP 200 OK:

json|Technical Specification / Reference
Verified Schema
{
  "requestID": 2049182,
  "dispositionMessage": "ISSUED",
  "binarySecurityToken": "MIIEzDCCA7SgAwIBAgIQX8...[NEW_PRODUCTION_X509_CERTIFICATE]...",
  "secret": "9a2f184b-012c-49a1-8d21-f0923841bc19",
  "errors": null
}

Within your database, execute an atomic transaction:

1Store the new binarySecurityToken and new secret.
2Swap the active signing key reference to new_private_key.pem.
3Retain the old certificate and private key in an archival vault to allow future verification of historical invoices.

Pathway B: Step-by-Step Emergency Renewal (After Expiration)

If your team missed the renewal window and your PCSID has expired, ZATCA's API will reject all requests authenticated with that token. Follow this recovery sequence:

Stage 01Corporate ERAD

Portal Login

Tax agent logs into ZATCA ERAD Portal via Nafath Business Single Sign-On

Stage 02Device Dashboard

Fatoora Platform Access

Navigate to E-Invoicing (Fatoora) Service → Onboarded Units Management

Stage 036-Digit OTP Generated

Revoke & Regenerate

Mark expired device as retired or request emergency renewal OTP

Stage 04Sandbox Test Engine

Compliance Cycle

Re-submit CSR via POST /compliance with OTP; pass 6 compliance sample invoices

Stage 05Live Invoicing Restored

Production Promotion

Promote verified device to a fresh Production CSID; restore live clearance

Step 1: Log in and Request a Renewal OTP

1Access the ZATCA Portal (https://zatca.gov.sa) and authenticate using Nafath.
2Select your establishment and open the Fatoora Platform (منصة فاتورة).
3Navigate to Registered EGS Units (الوحدات المسجلة).
4Locate the expired device. Click Renew Unit Credentials or Onboard Replacement Solution.
5Click Generate OTP. The portal provides a 6-digit numeric OTP valid for 60 minutes.

Step 2: Request Compliance CSID

Send an HTTP POST request to the /compliance endpoint:

http|Technical Specification / Reference
Verified Schema
POST /e-invoicing/core/compliance HTTP/1.1
Host: gw-fatoora.zatca.gov.sa
Accept-Language: en
Accept-Version: V2
OTP: 918240
Content-Type: application/json
json|Technical Specification / Reference
Verified Schema
{
  "csr": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0K...[NEW_CSR_BASE64]..."
}

Step 3: Pass Compliance Invoicing Checks

You must submit the mandatory compliance test document suite to /compliance/invoices:

1 Standard Tax Invoice
1 Standard Credit Note
1 Standard Debit Note
1 Simplified Tax Invoice
1 Simplified Credit Note
1 Simplified Debit Note

Step 4: Promote to Production CSID

Once all sample documents return "status": "PASS", call PATCH /production/csids with the compliance_request_id to acquire your new Production CSID.

Enterprise Key Custody & Archival Requirements

When rotating cryptographic credentials, enterprise IT teams must adhere to strict data retention rules under Saudi tax law:

Statutory Safeguards & Rights Protection

Mandatory protections enforced by MHRSD & Saudi Labor Law

1
Never Overwrite or Destroy Old Private KeysOld private keys must be permanently archived in an encrypted, read-only key vault. They are required to decrypt historical audit archives and verify historical digital signatures during official ZATCA tax audits.
2
Maintain Continuous Hash ChainingRenewing a CSID does NOT reset the Invoice Counter Value (ICV) or break the Previous Invoice Hash (PIH) chain. The first invoice signed with the new CSID must reference the hash of the last invoice signed with the old CSID.
3
Hardware Security Module (HSM) ComplianceLarge enterprises issuing over 100,000 invoices monthly are legally required to manage private keys within certified FIPS 140-2 Level 2 Hardware Security Modules.
4
Immediate Revocation of Leaked KeysIf an old private key is suspected of being compromised during server migration, the taxpayer must immediately revoke the certificate on the Fatoora Portal to prevent fraudulent billing.

Real-World Case Study: Zero-Downtime Renewal for a Retail Supermarket Chain

In January 2026, a major Riyadh retail hypermarket chain operating 84 POS terminals reached its 5-year Phase 2 certificate anniversary:

The Risk: Taking 84 cash registers offline during peak operating hours to run manual portal OTP requests would have halted checkout lanes and cost an estimated SAR 450,000 in lost trade.
The Architecture: The engineering team deployed an automated cron microservice 45 days prior to expiration.
The Execution: Every night at 03:00 AM, the microservice processed 10 registers sequentially. It generated fresh secp256k1 keys, executed PATCH /production/csids in under 800 milliseconds per unit, and swapped credentials in the local SQLite cache without restarting POS hardware.
The Outcome: All 84 terminals were rotated with zero minutes of retail downtime, zero customer delays, and 100% compliance verified on the Fatoora Portal.

Common Renewal Errors & Immediate Developer Fixes

HTTP Status / Error CodeUnderlying Technical CauseImmediate Developer Resolution
`401 Unauthorized: Expired Certificate`Attempted to use an already-expired PCSID to authenticate a proactive PATCH renewal request.The proactive window has passed. You must generate a fresh OTP on the Fatoora Portal and execute Pathway B.
`400 Bad Request: Invalid Common Name`The Common Name (CN) inside the renewal CSR does not match the original EGS serial number on ZATCA records.Ensure CN in the OpenSSL configuration matches the exact serial identifier registered during initial onboarding.
`400 Bad Request: Missing OID 0.9.2342...`The renewal CSR omitted the taxpayer VAT number OID or used an improper ASN.1 structure.Review the OpenSSL configuration file and verify that the 15-digit TRN is present under the custom ZATCA OID tag.
`Signature Verification Failed`The ERP attempted to sign live invoices with the new CSID using the old private key.Ensure the private key file path in your ERP signing engine is updated simultaneously with the certificate token.
`Hash Chain Broken on First New Invoice`The developer reset the ICV counter to 1 upon installing the new CSID certificate.Do not reset ICV. Maintain the continuous counter sequence (N + 1) and link to the previous invoice's SHA-256 hash.

Frequently Asked Questions (FAQ)

Can I renew my ZATCA CSID certificate before the 5-year expiration date?

Yes. Proactive renewal is strongly recommended between 30 and 60 days before your expiration date. Renewing proactively via the PATCH /production/csids API endpoint avoids the need to request a portal OTP or re-run compliance testing.

Does renewing a CSID reset the Invoice Counter Value (ICV)?

No. The Invoice Counter Value (ICV) is perpetual and belongs to the ongoing transaction sequence of your establishment. Renewing or rotating a certificate must never reset the ICV to 1.

What happens if an invoice is submitted to ZATCA using an expired CSID?

The ZATCA API immediately rejects the transaction with HTTP 401 Unauthorized / CERTIFICATE_EXPIRED. The invoice is not cleared, has zero legal tax validity, and the buyer cannot claim input VAT on the purchase.

Can an ERP vendor renew CSID certificates automatically without client permission?

An ERP system can automatically renew certificates via API only if the current PCSID is still valid and the software has been granted programmatic authorization to call the PATCH endpoint. If the certificate has expired, the client must log into the Fatoora Portal via Nafath to issue a new OTP.

Does changing our company's commercial name require a new CSID?

Yes. Because the legal company name is cryptographically sealed into the Subject of the X.509 certificate, updating your commercial name or registered branch address requires generating a new CSR and updating your certificate credentials.