Direct Answer / Quick Summary:

In Saudi Arabia's ZATCA Phase 2 E-Invoicing framework, a Cryptographic Stamp Identifier (CSID)—known in Arabic as Mu'arrif Al-Khatm Al-Mushaffar (معرف الختم المشفر)—is a specialized digital X.509 v3 public key certificate issued by the Zakat, Tax and Customs Authority. It acts as the legal cryptographic identity of an Electronic Generation Solution (EGS) unit.

Compliance CSID (CCSID): A temporary testing credential issued after submitting a CSR and portal OTP. It permits the device to interact only* with ZATCA's compliance evaluation engine to validate sample XML invoices. It cannot be used to clear real tax invoices.

Production CSID (PCSID): The permanent digital certificate issued once an EGS unit passes all automated compliance checks. Valid for 5 years*, it authorizes your ERP/POS system to sign legally binding invoices, request real-time B2B clearances, and submit B2C reporting feeds.

Binary Security Token & Secret: When a CSID is granted, ZATCA returns a Base64-encoded certificate (`binarySecurityToken`) and an API `secret`. Together, these form the credentials used for HTTP Basic Authentication* across all Fatoora API endpoints.

Cryptographic Foundation: ZATCA CSIDs enforce the Elliptic Curve Digital Signature Algorithm (ECDSA) with the secp256k1 curve*, embedding custom Object Identifiers (OIDs) for the taxpayer's 15-digit VAT number, branch address, and device serial number.

Architectural Purpose: What Problem Does a CSID Solve?

Before Phase 2, electronic invoices in Saudi Arabia were vulnerable to retroactive data tampering, backdating, and unauthorized alterations because PDF and text formats lacked immutable digital signatures.

Under Phase 2, ZATCA introduced a national Public Key Infrastructure (PKI). The CSID establishes non-repudiation and cryptographic integrity:

Stage 01Local ERP / HSM

Keypair Generation

EGS unit generates a private key (held securely locally) and a public key (embedded in CSR)

Stage 02ZATCA Certificate Authority

ZATCA CA Signing

ZATCA's Trust Sub-CA cryptographically signs the public key and returns the CSID certificate

Stage 03Tamper-Proof Payload

Digital Invoice Signing

EGS signs each outgoing UBL 2.1 XML document using its private key; embeds CSID in XML

Stage 04Real-Time Clearance

ZATCA Cloud Verification

ZATCA receives the invoice, verifies the signature against the active CSID, and clears the transaction

Through this mechanism, ZATCA can mathematically verify that an invoice was generated by an authorized, registered machine and has not been altered by a single byte since generation.

Comprehensive Comparison: Compliance CSID vs Production CSID

Developers and ERP integrators frequently confuse the roles and capabilities of the two certificate types. The following matrix outlines their critical differences:

Architectural DimensionCompliance CSID (CCSID)Production CSID (PCSID)Renewal CSID (RCSID)
Primary ObjectiveValidate software technical capability and schema conformance.Issue legal, tax-deductible commercial tax invoices.Extend validity of an existing onboarded EGS unit before expiration.
Issuance TriggerGenerated via /compliance endpoint using a 60-minute Fatoora Portal OTP.Granted via /production/csids after 100% compliance test pass rate.Issued via /production/csids using the active unexpired Production CSID.
Allowed EnvironmentsSimulation Sandbox and Compliance Engine.Live Production Gateway (/e-invoicing/core).Live Production Gateway (/e-invoicing/core).
Legal Validity of InvoicesZero. Strictly for test validation.100% Legal. Permitted for commercial billing.100% Legal. Seamless continuation.
Supported OperationsSample invoice clearance and reporting checks.Live B2B clearance, live B2C reporting, credit/debit notes.Continues live operations without billing interruption.
Certificate LifespanTemporary (expires once compliance checks complete or stall).5 Years from issuance date.5 Years from renewal issuance date.
API Endpoints Accessible/compliance/invoices, /production/csids./invoices/clearance/single, /invoices/reporting/single.Same as Production CSID.

Inside the CSID: X.509 Certificate Structure & Custom OIDs

A ZATCA CSID is not a standard web server SSL certificate. It is tailored with specific Object Identifiers (OIDs) mandated by Saudi e-invoicing standards:

Key Technical Parameters of the Certificate

Cryptographic Algorithm: ECDSA (Elliptic Curve Digital Signature Algorithm)
Underlying Curve: secp256k1 (standard Koblitz curve, 256-bit prime field)
Hashing Digest: SHA-256
Encoding Format: ASN.1 DER structure, encoded in Base64
Signing Authority: ZATCA Sub-CA (Production Trust Anchor)

Statutory Safeguards & Rights Protection

Mandatory protections enforced by MHRSD & Saudi Labor Law

1
UID (OID 0.9.2342.19200300.100.1.1)Encodes the taxpayer's 15-digit Tax Registration Number (TRN). Must match the VAT registration on ZATCA's ledger.
2
Title (T / OID 2.5.4.4)Encodes the 4-digit invoice capability flag: '1100' (Standard & Simplified), '1000' (Standard only), or '0100' (Simplified only).
3
Common Name (CN)Encodes the unique physical or logical EGS serial number (e.g., 'EGS1-POS04-HQ').
4
Organization Unit (OU)Specifies the branch location or business unit identifier.
5
Organization (O)Legal registered commercial name matching the Saudi Commercial Registration (CR).

If any of these fields are missing or improperly formatted during the CSR generation phase, ZATCA's compliance gateway automatically rejects the request with HTTP error 400 Bad Request: Invalid Subject DN.

How the CSID is Used in Live Invoicing Transactions

Once an enterprise secures a Production CSID, the certificate is utilized across two distinct technical workflows:

Workflow 1: Invoice Digital Signing (XML Payload)

When the ERP generates an electronic invoice according to the UBL 2.1 XML schema:

1The ERP removes the signature block and computes the SHA-256 Invoice Hash of the canonicalized XML.
2The ERP signs this invoice hash using the local secp256k1 Private Key.
3The resulting digital signature value, along with the complete Base64-encoded Production CSID X.509 Certificate, is injected directly into the <ds:Signature> element inside the UBL 2.1 XML.

Workflow 2: API Authentication (HTTP Basic Auth)

When transmitting the signed XML to ZATCA's cloud gateway for clearance or reporting:

1The ERP takes the binarySecurityToken (CSID) and the associated secret.
2It concatenates them with a colon: binarySecurityToken:secret.
3It encodes this concatenated string into Base64.
4It attaches the result to the request's Authorization header:
http|Technical Specification / Reference
Verified Schema
   Authorization: Basic TVRJRnFEQ0N...[BASE64_CREDENTIALS]...

Certificate Storage & Cryptographic Custody Requirements

Under ZATCA regulations, taxpayers bear strict statutory liability for the security and custody of their cryptographic credentials:

Stage 01Local Server / HSM

Secure Key Generation

Private keys must be generated inside secure enterprise hardware or encrypted environments

Stage 02Encrypted Vault

Restricted Access Vault

Private keys must NEVER be transmitted over networks, shared with vendors, or logged in text files

Stage 031:1 Mapping

Dedicated EGS Binding

A single CSID must never be duplicated across multiple physical cash registers or retail stores

Stage 04Immutable Ledger

Tamper-Proof Audit Log

Every invoice signature event must be permanently recorded with an incremental counter (ICV)

Compliance Warning / Enforcement Risk

Severe Penalties for Key Leakage:

Leaking or sharing your EGS private key is treated under Saudi law as a critical security breach. Any unauthorized tax invoices generated with your CSID will be legally attributed to your enterprise, resulting in immediate tax assessments and potential anti-fraud investigations.

The CSID Renewal & Revocation Lifecycle

A Production CSID does not last indefinitely. Enterprisewide IT governance must account for certificate rotation:

1. Routine Renewal (Prior to 5-Year Expiration)

Enterprises should initiate renewal 30 to 60 days before the 5-year expiration date.

Unlike initial onboarding, routine renewal does not require generating a new OTP from the Fatoora portal.
The ERP submits a new CSR to the /production/csids endpoint using its existing, active Production CSID for authentication.
ZATCA signs the new public key and returns an updated Production CSID valid for another 5 years.

2. Immediate Revocation Scenarios

An enterprise must immediately revoke a CSID via the Fatoora Portal dashboard under the following conditions:

A physical POS device or server containing the private key is lost, stolen, or compromised.
The branch is permanently closed or the Commercial Registration is cancelled.
The software architecture is retired in favor of a new ERP platform.

Common CSID Errors & Developer Fixes

Error Code / MessageUnderlying CauseDeveloper Resolution
`401 Unauthorized: Invalid Certificate`The API request is using a Compliance CSID on the production /core endpoint.Complete the compliance step and promote the certificate to a Production CSID via /production/csids.
`Signature Value Verification Failed`The private key used to sign the invoice does not match the public key in the CSID.Verify that the ERP is signing with the exact private key that generated the onboarded CSR.
`Invalid Basic Auth Format`Trailing whitespace or newline characters inside the Base64-encoded binarySecurityToken:secret header.Strip all newline characters (\r\n) from the token and secret strings prior to Base64 encoding.
`Certificate Revoked`The CSID was manually deactivated on the Fatoora Portal by company administration.Generate a fresh OTP on the portal and re-run the complete onboarding pipeline.
`400 Bad Request: Missing OID 0.9.2342...`The CSR was generated without the mandatory Taxpayer VAT Number OID.Update the OpenSSL req_extensions configuration file to include the required ZATCA custom OIDs.

Frequently Asked Questions (FAQ)

Can a single company have more than one CSID?

Yes. In fact, large enterprises typically operate dozens or hundreds of CSIDs. Every distinct physical POS terminal, individual cash register, or separate ERP billing node must possess its own unique serial number and dedicated CSID.

Does a CSID need to be renewed if the company changes its business address?

Yes. Because the physical branch location is cryptographically embedded into the Subject Distinguished Name of the CSID certificate, updating your commercial address requires generating a new CSR and re-onboarding the EGS unit.

Can an ERP vendor onboard a CSID on behalf of a taxpayer?

An ERP vendor can assist with the technical execution, but the taxpayer's authorized representative must log into the Fatoora Portal via Nafath/ERAD to generate the mandatory 6-digit OTP.

Is the CSID certificate visible to consumers on printed invoices?

No. The full CSID certificate is not printed in text on paper receipts. However, the cryptographic stamp derived from the CSID is encoded within the mandatory Base64 QR code on simplified B2C invoices and embedded in the XML of B2B invoices.

What happens if an invoice is submitted after the Production CSID expires?

The ZATCA clearance engine will immediately reject the transaction with an HTTP 401 Unauthorized / CERTIFICATE_EXPIRED error. The invoice will be legally invalid, and customers will be unable to claim VAT input deductions until the certificate is renewed.