ZATCA Phase 2 E-Invoicing: Why Compliance Passes But Reporting Fails

Developers integrating Saudi Arabia's ZATCA Phase 2 Fatoora e-invoicing system have reported a confusing error where invoices pass the compliance endpoint but fail at the reporting stage with a 'signed-properties-hashing' certificate error. The root cause lies in a mismatch between two versions of the XAdES SignedProperties block: the hashed version requires explicit namespace declarations and zero indentation, while the embedded version inherits namespaces from parent elements and is indented. A second common mistake involves computing the digest incorrectly — ZATCA expects a base64 encoding of the SHA-256 hex string, not a direct base64 digest, and the same rule applies to the certificate digest. The compliance endpoint does not validate this digest at all, meaning invoices can pass all four compliance sample checks and still fail on the first real reporting call. Developers are advised to generate both the hashed and embedded SignedProperties blocks from a single shared function to prevent drift, and to ensure SigningTime contains no milliseconds or 'Z' suffix.