XML validator

Checks

• Seal. It generates the original string with the SAT XSLT, verifies the signature with the public key in the Certificado attribute and reports whether it matches (CFDI40102). It also shows the original string so you can compare it with your system's.
• Certificate. It confirms that it is a CSD and not an e.firma, that NoCertificado belongs to the certificate, that its RFC is the issuer's and that the CFDI date falls within its validity. It reports whether it is a SAT test certificate, which only stamps in the sandbox, or a production certificate.
• Date. It confirms that the CFDI was issued no more than 72 hours earlier and that its date is not later than the local time at the LugarExpedicion postal code.
• Amounts, recipient and catalogs. It applies the same rules as the JSON validator: SubTotal, item and global taxes, Total, decimals, the recipient's regime and use, generic RFC and the short SAT code catalogs. Each rule shows its code. It also checks that 8% VAT is used with a place of issue in the border region.
• Payments 2.0. It checks the outstanding balance, the sum of ImpPagado against Monto and the value of MontoTotalPagos.
• Stamp. If the XML already contains a TimbreFiscalDigital, it shows the UUID, confirms that SelloCFD equals the CFDI seal and presents the original string of the stamp.
• Test RFCs. With a test CSD, it warns if the CSD is not in the LCO, if the issuer is an EFOS or if the name or postal code do not match the registered ones.

The validator does not query the SAT. It cannot determine whether a real RFC exists, whether a UUID is cancelled or whether the CSD is in the production LCO; the stamping provider performs those checks when stamping. To check the status of a stamped CFDI, use validator/cfdi.

Computing the original string

The string is computed with the SAT's official XSLT, cadenaoriginal_4_0.xslt, and the 33 complements it includes, among them payments, payroll, Carta Porte 2.0, 3.0 and 3.1, foreign trade, local taxes, tax legends and donations. Field order, omission of optional attributes and whitespace normalization follow that stylesheet, so the result matches the string the SAT computes.

When the seal does not match, the cause is usually one of the following: the XML was modified after sealing (a space inside a value, a rewritten decimal or a node in another position), the string was built manually or with another XSLT, the signature used SHA-1 instead of SHA-256, or another certificate's key was used.

Privacy