Digital certificate for VeriFactu in Dolibarr: how to install it, renew it and why it fails

To send invoices to VeriFactu from Dolibarr you need a qualified digital certificate: a company (legal entity) certificate or a signing certificate with power of attorney, currently valid, whose holder matches the tax ID (NIF) of the invoice issuer. If the submission to the Spanish Tax Agency (AEAT) fails, the odds are the certificate is the problem: expired, revoked, wrongly installed, or issued under a NIF that does not match.

What VeriFactu is and why it needs a digital certificate

VeriFactu is the invoice verification system of the Spanish Tax Agency (AEAT), established under Royal Decree 1007/2023 (RSIF regulation) and Law 11/2021 on anti-fraud measures. Billing software (SIF) sends each issued invoice to the AEAT when it validates it, and the Agency replies by accepting or rejecting it.

To sign and send those records you need a qualified, recognised certificate (eIDAS regulation) issued by a recognised trust service provider. The most common issuer in Spain is the FNMT, although others also issue valid certificates.

Which certificate do I need for VeriFactu

The certificate must meet four requirements:

• Currently valid: neither expired nor revoked.
• Issued by a recognised certification authority.
• Right holder: the NIF on the certificate must match the NIF of the taxpayer issuing the invoice.
• Power of attorney, when applicable: if a third party sends the invoices (an accounting firm, for example), a valid power of attorney must exist at the AEAT e-office for VeriFactu.

In practice, two certificates are used:

• Legal entity (company) certificate, issued in the name of the company: the most common one.
• Signing certificate with power of attorney, for a representative who signs on behalf of another person or company.

A personal certificate of a natural person — the e-DNI or the personal FNMT certificate — is not valid for signing on behalf of a company without a power of attorney: the AEAT compares the NIF on the certificate with the issuer's and rejects it.

What a power of attorney is

It is the authorisation granted by the taxpayer at the AEAT e-office for another person to handle procedures on their behalf. If the invoice sender is not the taxpayer, it must be in force and cover VeriFactu; without it, a valid certificate still gets the submission rejected.

How to get the certificate (FNMT)

1. Apply with identity verification: in person or by video.
2. Download it once issued, usually from your browser.
3. Export it to a .pfx or .p12 file, including the private key, and protect it with a password.

A .pfx or .p12 file is the certificate with its private key, encrypted with a password: the format billing software uses to sign records, because without the private key there is no signature. Keep a safe copy and never send it by email: whoever holds both can sign in your name.

How to install the certificate in Dolibarr

In Dolibarr the certificate is configured from the VeriFactu module: you upload the .pfx or .p12 file with its password, and the module uses it to sign each invoice.

Steps:

1. Make sure you have the certificate in .pfx/.p12 format and its password.
2. Open the VeriFactu module settings and upload the file.
3. Save the changes and run a trial submission (Test mode, if supported) before production.

Most common certificate errors and how to fix them

Certificate expired or revoked

Check its validity with the issuer (the FNMT has an online validator); if expired, renew and reinstall.

Wrong .pfx password

The password must match exactly; if the module cannot decrypt the private key, the submission fails.

Personal certificate instead of the company one

A personal certificate does not represent the company: use the legal entity certificate or a power of attorney.

The NIF on the certificate does not match the issuer

If you invoice under several entities, each issuer must use its own certificate.

Power of attorney not in force

If a third party (an accounting firm, for example) sends the invoices, the power of attorney must be in force and authorise VeriFactu.

The software keeps using the old certificate (PEM) after renewal

The classic: you renewed the certificate, but the ERP still signs with the previous file, sometimes in PEM. Replace it in the software and on the server, and restart services if needed.

Wrong server date or time

A desynchronised clock breaks the signature: check the server time (NTP) and timezone.

In VeriFactu these problems cause the whole submission to be rejected: the AEAT replies with 4100-series codes (4102, 4105, 4112, 4119) and no invoice in the batch gets registered. Our article on VeriFactu errors details each code and how to fix it.

How to renew the certificate without interrupting submissions

1. Renew before expiry. The FNMT warns you about 60 days ahead; renew with a margin.
2. Download the renewed certificate and export it to .pfx/.p12 again, with a new or the same password.
3. Replace the certificate in the software and on the server. The old file stops being valid as soon as the previous one expires.
4. Test the connection with a trial submission before continuing with real invoicing.

Best practices so submissions do not fail

• Always renew before expiry.
• Keep a password-protected copy of the .pfx in a safe place; never by email.
• After updating the ERP or changing the certificate, test the connection with the AEAT.
• Check each record's status: if the AEAT rejects one, correct it and resend it.

Download our free VeriFactu checklist to verify your installation before enabling the system.

The EasySoft VeriFactu module for Dolibarr

• One-time payment: no mandatory recurring fees and no forced subscription.
• Declaración Responsable (DR): the module includes the DR issued by EasySoft, satisfying the requirements of Royal Decree 1007/2023 and linked to the installation. More details in the article on the DR.
• Pre-launch audit: before activating VeriFactu we audit your installation — version, non-tampering measures, extrafields, QR, certificate and configuration — to spot problems before the AEAT does.
• Signing and sending to the AEAT: when you validate an invoice, the module signs it with your certificate and sends it (Test or Production mode), generates the QR code in standard PDFs and shows whether each record was accepted.
• TakePOS support for invoicing at the point of sale.

The deadlines applicable in Spain for each taxpayer type are covered in the article on deadlines. The VeriFactu for Dolibarr page explains the product in full.