e-CF Certificate

The e-CF Certificate is the cryptographic key that Mosce ERP uses to sign each XML it sends to the DGII. You have two modes: let the platform sign with its central certificate (recommended to start) or upload your own .p12 issued by the DGII and sign with it. This guide covers both.

Reading time: ~7 min

When to use this

• You are activating the Fiscal module for the first time and choosing between your own certificate or the platform's.
• Your DGII certificate is about to expire and you need to replace it.
• You changed certification provider or your RNC obtained a new certificate.
• You want to validate that the active certificate is current and signing correctly.

Before you start

• Your role includes fiscal:manage and the Fiscal configuration is already saved (RNC, legal name, and regime).
• If you are going to upload your own certificate: you have the .p12 or .pfx file issued by the DGII and the certificate password.
• You know the certificate's expiration date to plan the renewal.

The two certificate modes

Platform certificate (recommended to start)

Most tenants start with the Mosce ERP central certificate. In this mode:

• You do not have to obtain or upload any certificate file of your own.
• Mosce ERP signs each e-CF with the platform certificate.
• The only additional step is registering a delegation in the DGII Virtual Office.

The delegation is the formal record that authorizes the platform's RNC to sign electronic vouchers on your behalf. Without that record, the DGII will reject the e-CF because the signer's RNC signature does not match the issuer's RNC.

Steps:

1. Open Fiscal → Configuration and look at the lower card Certificate mode. It should say Platform.
2. If the Platform certificate delegation card appears, complete the registration in the DGII Virtual Office (see Fiscal configuration) and press I already registered the delegation.
3. Done - the e-CF you generate from Mosce ERP will be signed with the platform certificate using the delegated RNC.

Own certificate

Some organizations already have a digital certificate issued directly in their name before the DGII and prefer to keep it under their control. In that case, you can upload it to Mosce ERP:

1. Open Fiscal → Certificate from the tab.
2. Press Upload own certificate.
3. In the dialog:
   • .p12 file - select the certificate file (accepted extensions: .p12 and .pfx). This file must be a digital certificate for tax procedures, issued by a trust service provider accredited before INDOTEL, in compliance with the requirements set by the DGII.
   • Certificate password - the key with which the .p12 was generated. Use the field's eye to verify before submitting.
4. Press Upload. Mosce ERP decrypts the file, extracts the certificate, validates the trust chain, and stores the bytes encrypted with AES-256-GCM.
5. If the certificate is valid, you will see:
   • Subject (CN) - name of the certificate holder.
   • Issuer - the certification authority (normally DGII or an accredited entity).
   • Valid from / Valid to - validity dates.
   • Status - Current, Expiring soon (within the next 30 days) or Expired.
6. The certificate mode in Configuration changes automatically to Own.

How to obtain a digital certificate

If you do not yet have a digital certificate for tax procedures, you can obtain it through the trust service providers enabled by INDOTEL and recognized by the DGII. The process includes identity verification of the taxpayer's legal representative.

For the updated list of providers and the requirements to obtain one, consult the DGII portal.

Validate the certificate

After uploading the certificate, you can run a validation to confirm that it signs correctly:

1. In the Certificate tab, press Validate.
2. Mosce ERP performs a test signature with a known payload and verifies the result.
3. If the signature is valid you will see Valid certificate. If it fails, the error message tells you what to fix (trust chain, expiration, incorrect password, etc.).

Deactivate or delete a certificate

• Deactivate - the certificate is marked inactive and Mosce ERP goes back to signing with the platform certificate. Useful when you are going to change providers without losing the file yet.
• Delete - permanently removes the certificate and its encrypted password. You can only do this if there are no more e-CF pending signature with that certificate.

Plan the renewal

Mosce ERP marks the certificate as Expiring soon when there are 30 days or fewer left. At that point:

1. Start the renewal process with the trust service provider or with the DGII.
2. When you obtain the new .p12, upload it from the Certificate tab.
3. Run the validation to confirm that the new certificate signs correctly.
4. The old certificate can be deactivated once the new one is active.

Planning ahead prevents e-CF issuance from being blocked by an expired certificate.

Expected result

• In platform mode: Delegation confirmed card with a date, and the e-CF are signed automatically.
• In own mode: certificate visible with holder, issuer, validity dates, and Current status.
• The validation finishes successfully and new e-CF are signed without error.

Common errors

Related

• Fiscal configuration
• e-CF Sequences
• e-CF Documents
• Certification process
• DGII Reports