The digital certificate: what it is, why it signs your invoices and how InvoSeal manages it for you

The digital certificate: what it is, why it signs your invoices and how InvoSeal manages it for you

Behind every electronic invoice with full legal validity sits a component almost nobody looks at: the digital certificate that signs it. Understanding what it does — and who safeguards it — is understanding why your invoice holds up before the AEAT, a judge and your customer.

What a digital certificate is

A cryptographic file issued by a certification authority (in Spain, typically the FNMT) that binds an identity — you or your company — to a key pair. The private key signs; the certificate lets anyone verify that the signature is yours and the document was not altered afterwards.

Applied to invoicing: the electronic signature guarantees authenticity (it was issued by who it says) and integrity (not a cent was touched after issuance) — exactly the two requirements Spanish invoicing rules set for electronic invoices.

Signature, hash chain and VeriFactu: three complementary layers

• The electronic signature seals the individual document.
• VeriFactu's chained hash links every invoicing record to the previous one: deleting or inserting invoices breaks the chain.
• The invoice's QR code lets any recipient cross-check it.

InvoSeal applies all three layers automatically when you press «Issue»: you see a button; underneath happen the signature, the chained registration and the QR generation.

Your own certificate or the platform seal?

Both models are valid and coexist:

• Customer certificate: you upload your certificate (or your company's), and invoices are signed with your identity. Usual for those who also use it elsewhere (AEAT filings, notifications).
• Delegated platform signature: InvoSeal signs as a provider with its own qualified seals, within the legal framework of delegated invoicing. For the invoice's validity, the result is equivalent.

Under My account → Certificates you can see the active model, upload a new one or renew the existing one.

Expiry: the avoidable scare

Certificates expire (2–4 years depending on type). An expired certificate does not invalidate invoices already signed — a signature is assessed as of its issuance date — but it blocks new ones. Typical symptom: an invoice stuck in «processing» with a signature error.

InvoSeal warns you ahead of expiry for uploaded certificates. Still, note the date: FNMT renewal takes a few minutes of procedure (sometimes in-person identification) best not done with ten invoices stuck in the queue.

Questions that reach Support

• Can I invoice without a certificate? With delegated signature, yes — the platform provides the cryptography. What doesn't exist is a fully valid e-invoice "signed by nobody".
• Does my certificate ever leave InvoSeal? No: stored encrypted, used exclusively to sign your documents, removable at any time.
• What if I change companies? New tax ID = new certificate. Old invoices remain signed with the previous one, as they should.

Doubts about your case (representative certificates, powers of attorney, renewal)? Open a Support ticket — this is one of those topics where ten minutes in time save an entire morning.