Understanding the Core of ZATCA Phase 2: Digital Signatures and CSID

As Saudi Arabia moves deeper into Phase 2 (Integration Phase) of the Fatoora project, the technical requirements for businesses have shifted from simple QR codes to complex cryptographic security. At the heart of this transition are two critical components: the Digital Signature and the Cryptographic Stamp Identifier (CSID).

For many Saudi SMEs, these terms can feel like a technical maze. However, understanding them is essential for maintaining ZATCA compliance and avoiding heavy penalties. In this guide, we will break down everything you need to know about CSIDs, digital signatures, and how to successfully onboard your Electronic Generating Solution (EGS).

1. What is a CSID (Cryptographic Stamp Identifier)?

A CSID is essentially a digital identity card for your accounting software or ERP system. It tells ZATCA’s systems exactly which device or software instance is issuing an invoice. Think of it as a digital seal that proves the authenticity of the sender.

There are two types of CSIDs you will encounter:

CCSID (Compliance CSID): A temporary certificate used during the testing phase in the ZATCA Sandbox. It allows you to ensure your XML files are correctly formatted without affecting your official tax records.
PCSID (Production CSID): The permanent certificate used for real-world transactions. This is what you use to sign and report invoices to the Fatoora portal in a live environment.

Why do you need it?

Under Phase 2 regulations, every invoice must be cryptographically linked to the taxpayer. The CSID contains the public key that ZATCA uses to verify the Digital Signature attached to your invoices.

💡 Pro Tip: If you are using Qeemah, the generation and management of these certificates are handled automatically within our ZATCA Hub, saving your IT team hours of manual configuration.

2. The Role of Digital Signatures in E-Invoicing

In Phase 1, a QR code was sufficient. In Phase 2, ZATCA requires a Digital Signature (based on the XAdES-EPES standard) for all Simplified Tax Invoices (B2C).

How it Works:

Hashing: The software creates a unique digital fingerprint (Hash) of the invoice data using the SHA-256 algorithm.
Signing: This hash is encrypted using your private key (linked to your CSID).
Verification: When ZATCA receives the invoice, they use your public key (from your CSID) to decrypt the hash. If the hashes match, the invoice is authentic and has not been tampered with.

Key Technical Components:

UUID (Universally Unique Identifier): A 128-bit number that uniquely identifies each invoice.
ICV (Invoice Counter Value): A sequence number that prevents the re-use of old signatures.
PIH (Previous Invoice Hash): A cryptographic link to the previous invoice, creating a “chain” that makes it impossible to delete or alter past records without breaking the sequence.

3. Step-by-Step: The Onboarding Process (CSR to PCSID)

To get your production certificate, you must follow a specific technical workflow. Here is the standard process for Saudi businesses:

Step 1: Generate a CSR (Certificate Signing Request)

Your EGS must generate a CSR file. This file contains your business details (CR Number, VAT Number, Organization Unit) and a public key.

⚠️ Warning: The CSR must follow specific ZATCA formatting. Any mismatch in the VAT number or Common Name will result in an immediate rejection.

Step 2: Obtain an OTP from Fatoora Portal

Log in to the ZATCA Fatoora Portal and generate a One-Time Password (OTP) for each device/solution you want to onboard.

Step 3: Compliance Testing (CCSID)

Submit your CSR and OTP to the ZATCA API. You will receive a CCSID. You must then pass a series of compliance tests by submitting sample invoices (Standard and Simplified) to the Sandbox environment.

Step 4: Production Onboarding (PCSID)

Once the compliance checks are passed, you request the PCSID. This certificate is valid for a specific period (typically 1 year) and must be renewed before it expires.

Feature	CCSID (Compliance)	PCSID (Production)
Environment	Sandbox / Testing	Live / Production
Legal Status	Non-binding	Tax-binding
Purpose	Validation of XML structure	Reporting & Clearing
Requirement	Required for all new integrations	Mandatory for Phase 2 go-live

4. Common Errors and Troubleshooting

Integrating with ZATCA’s API often results in technical errors. Here are the most common ones related to CSIDs and signatures:

Error 401 (Unauthorized): Usually means your CSID has expired or the binary security token in your request header is malformed.
BR-KSA-31: This indicates a signature validation error. It often happens if the invoice content was changed after the signature was generated.
Invalid PIH: This occurs if the hash of the previous invoice submitted does not match the record in ZATCA’s sequence.

✅ Solution: Use our ZATCA Readiness Checker to validate your XML files before submission.

5. Security Best Practices for Saudi SMEs

Digital signatures are legally binding. If your private keys are compromised, unauthorized invoices could be issued in your name.

Never Share Private Keys: Your private key should stay within your secure server environment.
Monitor Certificate Expiry: Set reminders 30 days before your PCSID expires to avoid service interruptions.
Automate with Trusted Providers: Manual management of CSRs and XML signing is prone to error. Using a certified cloud accounting provider like Qeemah ensures that these security layers are managed automatically.

How Qeemah Simplifies ZATCA Phase 2

Navigating the technicalities of XAdES signatures, Base64 encoding, and CSR generation shouldn’t be your job—it should be your software’s job.

Qeemah is designed specifically for the Saudi market, offering:

One-Click Onboarding: Generate CSRs and fetch PCSIDs directly from our interface.
Automatic Signing: Every invoice is signed, hashed, and chained (PIH) automatically in the background.
Real-time Integration: Direct API connection to ZATCA for instant clearance of Standard invoices and reporting of Simplified invoices.
Compliance Dashboard: Track the status of every submission and fix errors with guided prompts.

Don’t let technical complexity slow down your business. Stay compliant, stay secure, and focus on your growth.

Explore Qeemah’s ZATCA Features | View Our Pricing

ZATCA Digital Signature & CSID Guide: Master Phase 2 Integration