FirmaSAT

Using From the Command Line

Syntax:
FirmaSAT ACTION [OPTIONS] [-o outfile] [-i] infile
For help on the available actions type
FirmaSAT HELP
> FirmaSAT HELP
Usage: FirmaSAT ACTION [OPTIONS] [-o outfile] [-i] infile
ACTION (one of):
 ASCIIFY        = replace non-ASCII characters with XML character references.
 ATTRIBUTE      = extract a given attribute from XML file.
 CERTSTRING     = get the certificate data as a base64 string.
 EXTRACTDIGEST  = extract the digest from the signature.
 FORMDIGEST     = form the digest of the pipestring.
 GETKEYSTRING   = get the private key as a base64 string.
 HELP           = display this help.
 HELP-OPTIONS   = display help for options.
 INSERTCERT     = insert certificate details into XML file.
 KEYCHECK       = check that key matches certificate.
 LIBINFO        = display DLL library details.
 MAKESIG        = make signature from XML file.
 NEWKEY         = save key file with a new password.
 NUMBERCERT     = get the certificate serial number.
 PIPESTRING     = make pipestring (cadena) from XML file.
 QUERYCERT      = query a certificate for a given value (use -q option).
 RECEIPTVERSION = get receipt version number or file ID.
 SIGNXML        = create the signature and set `sello` field in XML file.
 UTF8FIX        = add UTF-8 byte-order mark to a file.
 UUID           = generate a Universally Unique IDentifier (UUID).
 VERIFYSIG      = verify the signature in XML file.
 WRITEPFX       = create PFX file from private key and certificate.
 XMLOK          = validate XML file.
For help type ``FirmaSAT HELP [KEYWORD]'' (en espanol ``FirmaSAT AYUDA'')
For options ``FirmaSAT HELP-OPTIONS'' (en espanol ``FirmaSAT AYUDA-OPCIONES'')
For help on the options type
FirmaSAT HELP-OPTIONS
> FirmaSAT HELP-OPTIONS
Usage: FirmaSAT ACTION [OPTIONS] [-o outfile] [-i] infile
OPTIONS:
 -a <attribute-name> required for ATTRIBUTE action
 -b process Big files with SIGNXML/VERIFYSIG/FORMDIGEST/MAKESIG
 -c <certfile>       X.509 certificate for VERIFYSIG/SIGNXML/INSERTCERT
 -d show Debug info; -dd show more
 -e <element-name>   required for ATTRIBUTE action
 -f act on tfd:TimbreFiscalDigital node instead of document root element
 -k <keyfile>        required for SIGNXML/KEYCHECK/MAKESIG/NEWKEY
 -l (letter 'ell')   use Loose XML restrictions with XMLOK (default=strict)
 -m output encrypted private key in peM format with GETKEYSTRING/NEWKEY
 -n <newpassword>    new password for WRITEPFX/NEWKEY
 -p <password>       required for <keyfile>
 -q <query>          required for QUERYCERT where <query> is one of
              {rfc|orgName|notAfter|notBefore|serialNumber|sigAlg|keySize}
 -s <statusfile>     default=none; for stdout use ``-s @''
 -t <tracking-info>  optional info for the status file
 -w display output in Windows console font
 -x eXclude BOM in output file with SIGNXML
 -y output XML using emptY-element tags with SIGNXML
 -1 (number 'one')   encode QUERYCERT/ATTRIBUTE in Latin-1 (default=UTF-8)
For help type ``FirmaSAT HELP [KEYWORD]'' (en espanol ``FirmaSAT AYUDA'')
For options ``FirmaSAT HELP-OPTIONS'' (en espanol ``FirmaSAT AYUDA-OPCIONES'')
To get help on an individual action type ``FirmaSAT HELP <action-name>``. For example
FirmaSAT HELP EXTRACTDIGEST
> FirmaSAT HELP EXTRACTDIGEST
FirmaSAT EXTRACTDIGEST [-c <certfile>] [-f] <xmlfile>
 Extracts the message digest from the signature ('sello') in file <xmlfile>.
 * Use the `-c` option to specify a separate X.509 certificate for the public
   key [default = use embedded certificate]
 * Use the `-f` option to extract the digest from the TFD element, if present.
   Requires `-c <certfile>` of the signer
En espanol: Extractos del resumen del mensaje de la firma ('Sello') en un
   archivo XML.
To see the detailed help on all the actions type
FirmaSAT HELP HELP

Example

> FirmaSAT SIGNXML -s @ -k emisor.key -p 12345678a -c emisor.cer -i cfdv33a-base.xml -o cfdv33a_new-signed.xml
STATUS: 0
ERRORDESCRIPTION: OK
DATETIMECREATED: Sun Aug 18 18:52:36 2019

This takes an input XML file cfdv33a-base.xml together with the signer's X.509 certificate file emisor.cer and private key emisor.key with password "12345678a". The signed XML document is output as cfdv33a_new-signed.xml.

The input XML is a CFDi v3.3 document with all fields completed except the "Certificado" and "Sello" attributes. The signed output file has these fields completed.

<cfdi:Comprobante xmlns:cfdi="http://www.sat.gob.mx/cfd/3"
Version="3.3" ...
NoCertificado="30001000000300023708"
Certificado=""
Sello=""
...>
<cfdi:Comprobante xmlns:cfdi="http://www.sat.gob.mx/cfd/3"
Version="3.3" ...
NoCertificado="30001000000300023708" 
Certificado="MIIE/TCCA+WgAwIBAgIUMzAwMDEwMDAwMD..." 
Sello="Te/+FS80gNruYgYIWu4WXftCSdvSfGI..."
...>
The user obtained the "NoCertificado" from their X.509 certificate using the "QUERYCERT" action.
> FirmaSAT QUERYCERT -q serialNumber emisor.cer
30001000000300023708

For more details on using the SIGNXML action see Sign XML in the FirmaSAT manual.