Device Certificate
In order to comply with TicketBAI, the billing or POS system must be equipped with a software that generates an XML file for each transaction, signs it with a digital certificate and sends it to the corresponding Tax Authority.
The signature of the TicketBAI Files is carried out in the SIGN ES API signing component.
Each invoice will be chained to the previous one and the digital signature guarantees that the information is not tampered with. For this, a digital certificate provided by a Qualified Trust Service Provider (eIDAS QTSP) is required.
TicketBAI legislation allows the use of the following types of Digital Certificates:
- Device certificate
- Natural person or entity representative certificate
- Company seal
- Self-employed certificate
Why use our device certificate?
At fiskaly, we've decided to implement a Device Certificate due to its multiple advantages:
- It has been created exclusively for TicketBAI. It does not provide access to any other of the taxpayer's information within the Tax Authority.
- The taxpayer does not have to provide it's own private certificate.
- The signing and sending of the TicketBAI files can be done with the same certificate.
fiskaly’s SIGN ES API uses a Device Certificate provided exclusively for TicketBAI by Izenpe. The certificate is contained by each Signing Device object, but must be associated to the taxpayer’s NIF within the corresponding Tax Authority.
By performing the registration of fiskaly’s Device Certificate, the effort is minimized. However, the system allows for the introduction of an Optional Device Certificate by the POS provider if required.
SIGN ES API supports two kinds of device certificates, both compliant with TicketBAI regulations:
Managed certificates: fiskaly-managed device certificates. We take care of the issuance of certificates and provide a device certificate for each signer, you don’t have to worry about maintenance of the certificates, only tell the merchant to register the serial number as indicated in “How do I register the device certificate?”
External certificates: taxpayer-managed device certificates. The integrator has to provide the specific device certificate created in the Izenpe website, following the instructions detailed in Optional Device Certificate. fiskaly does not handle the maintenance of this certificates.
Using fiskaly’s device certificate for the signer creation allows you to be compliant without any additional effort!
How do I register the device certificate?
In order to send the TicketBAI Files to the Tax Authorities using a Device Certificate, the certificate has to be associated to the VAT Number (NIF) of the taxpayer who is issuing the invoices. This is a simple process done within the corresponding Tax Authority's website:
The device certificate registration in Araba and in Bizkaia has to be done before the device starts issuing invoices in the taxpayer's name, by providing the serial number of the device certificate.
The device certificate registration in Gipuzkoa has to be done after the first invoice has been issued, by accepting the certificate.
The taxpayer will have to log in to the Tax Authority's website, using their personal certificate. Once logged in, the Device Certificate's Serial Number has to be informed, which will be provided by fiskaly or the POS provider.
The device certificate serial number can be retrieved from the SIGN ES API through the Retrieve a signer endpoint. The content of this response will provide the certificate information, where the serial_number of the TicketBAI device certificate will be found.
The VAT Number (NIF) indicated must be associated with the Device Certificate used. If the taxpayer fails to inform the Device Certificate’s number to the Tax Authority, the mandatory sending of TicketBAI Files will result in rejection. This registration is the only required step to be performed on behalf of the taxpayer.
Due to the certificate type used, TicketBAI legislation does not allow for the creation of invoices by a third party or recipient. Only invoices created by the taxpayer indicated in the Signing component can be issued and sent to the Tax Authorities with a device certificate.