A bash script to generate valid test certificates for the El Salvador Electronic Tax Document (DTE) signing API.
This script generates XML certificates in the custom format required by the SVFE (Sistema de Facturación Virtual Electrónica) API for document signing. The certificates contain RSA key pairs and are compatible with the Java Spring Boot application that handles DTE digital signatures.
- ✅ Generates valid XML certificates that work with the SVFE API
- ✅ Uses proper RSA-2048 key pairs in Base64 DER format
- ✅ Creates SHA512 password hashes for authentication
- ✅ Supports custom NIT (tax ID) and password combinations
- ✅ Uses epoch timestamps compatible with Jackson JavaTimeModule
- ✅ Produces certificates ready for document signing operations
# Make the script executable
chmod +x generate_test_certificate.sh
# Generate certificate with default values
./generate_test_certificate.sh
# Generate certificate with custom NIT and password
./generate_test_certificate.sh "12345678901234" "mypassword123"- NIT (optional): 14-digit tax identification number (default: "12345678901234")
- Password (optional): Private key password (default: "test123")
The script generates a .crt file named after the NIT containing:
- Public Key: RSA-2048 public key in X.509 format
- Private Key: RSA-2048 private key in PKCS#8 format
- Certificate Metadata: Issuer, subject, validity periods, extensions
- Password Hashes: SHA512 hashes for key authentication
The generated certificates use a custom XML format specific to the El Salvador Ministry of Finance (Ministerio de Hacienda) requirements:
<CertificadoMH>
<_id>mongodb_object_id</_id>
<nit>tax_identification_number</nit>
<publicKey>
<keyType>PUBLIC</keyType>
<algorithm>RSA</algorithm>
<encodied>base64_encoded_public_key</encodied>
<format>X.509</format>
<clave>sha512_hash</clave>
</publicKey>
<privateKey>
<keyType>PRIVATE</keyType>
<algorithm>RSA</algorithm>
<encodied>base64_encoded_private_key</encodied>
<format>PKCS#8</format>
<clave>sha512_password_hash</clave>
</privateKey>
<!-- Additional certificate metadata -->
</CertificadoMH>After generating a certificate, copy it to your application's upload directory and test with:
# Copy certificate to uploads directory
cp [NIT].crt uploads/
# Test API endpoint
curl -X POST http://localhost:8113/firmardocumento/ \
-H 'Content-Type: application/json' \
-d '{
"nit": "your_nit_here",
"passwordPri": "your_password_here",
"dteJson": {"test": "document"}
}'- Algorithm: RSA-2048
- Signature Algorithm: RSA-SHA512 (RS512)
- Key Format: PKCS#8 (private), X.509 (public)
- Encoding: Base64 DER
- Hash Function: SHA512 for password validation
- Issuer: Ministerio de Hacienda - El Salvador
- Organization: Dirección General de Impuestos Internos
- Validity: 1 year from generation date
- Key Usage: Digital Signature, Content Commitment
- The RSA key pairs are hardcoded and publicly available
- Do NOT use these certificates in production environments
- For production, use certificates issued by the official El Salvador CA
- Private keys should be generated securely and kept confidential
- Java Spring Boot: Compatible with Jackson XML parsing
- JOSE4J: Works with JSON Web Signature (JWS) creation
- BouncyCastle: Compatible with RSA key operations
- OpenSSL: Uses OpenSSL for hash generation
bash(shell environment)openssl(for SHA512 hash generation)date(for timestamp generation)
The script includes validation for common issues:
- Ensures proper password hash generation
- Uses epoch timestamps for date compatibility
- Generates valid MongoDB-style object IDs
- Creates properly formatted XML structure
This script is provided for educational and testing purposes. Use in accordance with El Salvador's electronic invoicing regulations and your organization's security policies.
Generated for: El Salvador Electronic Tax Document (DTE) System
Compatible with: SVFE API Firmador (Java Spring Boot)
Last Updated: June 2024