Skip to content
pluginloom

Setup

Your electronic certificate

Which certificate the AEAT accepts, how to upload it to Encadena, how it is stored, and what to do when the certificate holder is not the business.

Last updated by the PluginLoom team

The AEAT only accepts records sent with a qualified electronic certificate, and NO VERI*FACTU mode uses the same kind of certificate to sign every record. Getting it is your job: Encadena cannot get one for you.

Which certificate?#

  • A qualified certificate from a provider on the EU trusted list, valid on the day of use (Orden HAC/1177/2024 arts. 5 and 14; AEAT signature specification v0.1.5, section 3).
  • Its holder must be the business that issues the invoices, or someone authorised to act for it: an apoderado or a colaborador social (RD 1065/2007 arts. 79 to 81, cited in Orden art. 5).
  • Electronic seal certificates (certificado de sello) are accepted on a separate AEAT port. Tick the seal box when you upload one.

Sources: Orden HAC/1177/2024 (opens in a new tab); AEAT signature specification (opens in a new tab), checked October 24, 2026.

How do I upload it?#

  1. Export the certificate with its private key from your browser or certificate manager as a .pfx or .p12 file with a password.
  2. Go to Verifactu > Settings > Electronic certificate, choose the file, type the password and click Upload certificate.
  3. Check the holder, NIF and expiry date shown.

If you see "old encryption format", your server's OpenSSL cannot read the file. Export it again choosing AES encryption, or upload a PEM file with the certificate and the private key.

How is it stored?#

  • The private key is encrypted (libsodium XChaCha20-Poly1305, or AES-256-GCM).
  • The password is used once to open the file and is never stored.
  • For extra protection, define ENCADENA_ENCRYPTION_KEY in wp-config.php so the encryption key lives outside the database.
  • During a submission the key is written to a private temporary file for the length of the request and deleted straight after.

The certificate NIF is not my business NIF#

That works only if the holder is authorised at the AEAT to send on your behalf. If not, the AEAT rejects the whole submission with error 4112. If an adviser sends with their own certificate, also fill in Representative NIF in Settings.

Expiry#

Encadena warns 30 days before the certificate expires. An expired certificate stops submissions (VERIFACTU) or signatures (NO VERIFACTU); invoicing continues and records wait in the queue until you upload a valid one.

Was this page helpful?