The A1 certificate
What the product checks on upload, how the certificate is stored, and how to replace it.
Upload the .pfx or .p12 file with its password in Issuer. Only an administrator can do it. The file can be up to 5 MB.
What is checked
- The password opens the file, and the key is RSA.
- The certificate is within its validity period: not expired, not yet to start.
- It carries a CNPJ, and the root of that CNPJ (the first 8 digits) matches the issuer’s. A head-office certificate signs for its branches.
- It is not self-signed. Self-signed certificates are accepted only in the sandbox.
The same checks run again every time the certificate signs. An expired certificate stops transmission instead of producing an invoice the government will refuse.
How it is stored
The file is encrypted with AES-256-GCM under a key of its own; that key is wrapped by a master key kept in the server environment, never in the database. At transmission time the certificate is opened to sign the document and to start the mutual-TLS session with the government, and the temporary material is removed right after. The master key can be rotated without re-uploading any certificate.
Expiry and replacement
- The panel shows the days left: amber under 60 days, red under 30. Renew with your certification authority before that.
- Replacing is a new upload. The new certificate becomes the active one; the previous one stays encrypted and inactive, so the record of which certificate signed which invoice stays whole.