Manage the company digital certificate

Before you start

Use a user with the Administrator profile. Have the certificate file (.pfx or .p12) and its password, received from the certification authority.

Step by step

1. Know the A1 and A3 certificates

The company signs its fiscal documents with an e-CNPJ certificate of the ICP-Brasil.

• The A1 is a file (.pfx or .p12) protected by a password. It is registered in Odoo, in Fiscal > Configuration > Certificate, and linked to the company. It usually lasts one year.
• The A3 is stored in a token or smart card and stays with the person who holds it. It can last up to five years.

To issue from Odoo, use the A1: it is the file the company registers and links to each company that issues.

2. Buy from an accredited authority

The e-CNPJ is sold by the certification authorities accredited in the ICP-Brasil; the list is on the ITI (National Institute of Information Technology) website. The legal representative of the company validates the identity, in person or by video call, and receives the A1 file and the password.

Buy the certificate for the CNPJ that issues the fiscal documents. A branch can use the head office certificate, which has the same CNPJ root, or a certificate of its own.

3. Check validity and holder

Open the certificate in Fiscal > Configuration > Certificate. Odoo reads from the file the holder (company name and CNPJ), the issuer, the start date and the expiration date, and shows whether the certificate is valid. In Settings > Companies, the Fiscal > Certificates tab shows which certificate signs the NF-e of each company.

4. Renew on time

Start the renewal about a month before the expiration: buy the new certificate, validate the identity and receive the file. Then register the new certificate and switch it in the Certificates tab of the company. Issuance does not stop: the next fiscal document is already signed with the new certificate, and the documents authorized before stay valid.

To be warned in time, schedule an activity on the certificate itself, for the person who takes care of the renewal, one month before the expiration.

5. When SEFAZ refuses because of the certificate

If Odoo cannot open the file when you save the certificate, the problem is the password, not SEFAZ: confirm the password with the certification authority and use the original file.

When SEFAZ refuses the fiscal document, read the rejection code and check:

• Validity (rejections 281 and 291): the certificate is past its expiration date. Register the renewed certificate and switch it in the company.
• Accredited authority (rejections 285 and 295): the certificate was not issued by an authority accredited in the ICP-Brasil. Use the e-CNPJ issued by an accredited authority.
• Certification chain (rejections 283 and 293): the certification chain has an error, for example an incomplete chain. Install the full chain with the certificate.
• Different CNPJ (rejection 213): the CNPJ root of the certificate is not the same as the issuer's. Link to each company a certificate with its CNPJ root.

Expected result

Each company issues with a valid certificate of its own CNPJ root, the renewal is scheduled before the expiration, and a refusal by certificate is solved by checking password, validity, chain and CNPJ.

If something goes wrong

• The certificate appears as not valid: the expiration date has passed. Register the renewed certificate.

• The fiscal document was signed with the old certificate: the company still points to it in the Certificates tab. Switch it before transmitting the next document.

Continue the process

• Configure the company tax regime and fiscal data
• Prepare, send and check an NF-e
• Configure the document types, series and numbering