Cert4Sign is NOT affiliated with or authorized by ZATCA. This is an open-source reference implementation for testing and simulation purposes only. No hosted service is offered, and the runnable source code is in pre-release — this domain hosts documentation only. Watch the GitHub repository for the release.

About Cert4Sign

A planned open-source reference implementation of the full ZATCA Phase 2 e-invoicing onboarding flow in Saudi Arabia — CSR generation, Compliance CSID, test-invoice submission, and Production CSID. The runnable source has not been published yet. No hosted service is offered; this site hosts documentation only.

What is ZATCA E-Invoicing?

ZATCA (Zakat, Tax and Customs Authority) requires all businesses in Saudi Arabia to generate and submit electronic invoices. Each business must obtain a digital certificate to sign their invoices before submission through the Fatoora portal.

How the Implementation Will Work

Once released, the codebase will walk through the following five steps when run locally:

Subject DN — collects organization details: Country, Organization name, TIN, and Common Name.

Taxpayer Details — collects ZATCA-specific fields: Tax ID, Invoice Type, Address, and Business Category.

EGS Device — registers the e-invoicing device with name, model, and a generated UUID.

Environment & OTP — accepts the target environment (Sandbox, Simulation, or Production) and the OTP from ZATCA.

Review & Generate — produces a PKCS#10 CSR and submits it to ZATCA for a Compliance CSID.

Technical Details

The CSR is generated using proper ASN.1/DER encoding with the following specifications:

Key Algorithm: ECDSA with secp256k1 curve (ZATCA requirement)
Signature: ecdsa-with-SHA256
CSR Format: PKCS#10 (RFC 2986)
Extensions: SubjectAltName with DirectoryName, CertificateTemplateName
Certificate Template: PREZATCA-Code-Signing

secp256k1 SHA-256 PKCS#10 ASN.1/DER X.509v3 Cloudflare Workers

ZATCA Compliance Flow

After generating the CSR, the full ZATCA compliance process involves:

Submit CSR to obtain a Compliance CSID (CCSID)
Generate 6 test invoices (Standard, Simplified, Debit/Credit Notes)
Submit test invoices for compliance validation
Obtain Production CSID (PCSID) after passing compliance
Use PCSID for reporting/clearance of real invoices

Security & Data Handling

Cert4Sign will be published as open source on GitHub; once released, every line will be publicly auditable. Because no hosted service is offered — and the runnable source has not been published yet — no certificates, OTPs, or keys ever touch maintainer infrastructure. The planned design is:

Private keys will be generated per request, returned only to the caller in the response, and never written to any database, log, or persistent storage.
OTPs will be forwarded directly to ZATCA's official endpoints in the same request and never persisted by the application.
ZATCA traffic will go only to ZATCA's official gateway (gw-fatoora.zatca.gov.sa). No third-party intermediaries.
Server-side calls will run on Cloudflare Workers; the source for every Worker route will be in the public repo when released.

For security vulnerabilities or responsible disclosure, email security@cert4sign.com. For abuse reports or domain-misrepresentation concerns, email support@cert4sign.com.