What Is a Digital Seal Certificate (CSD) in Mexico

What Is a Digital Seal Certificate (CSD)?

A digital seal certificate (Certificado de Sello Digital, or CSD) is the file Mexico's tax authority, the SAT, issues so you can electronically sign every invoice you issue: without a valid CSD, your invoicing system cannot generate a legally valid CFDI. Technically it's a pair of files — a public one (.cer) and a private one (.key), protected by a password you set — that together prove an invoice came from your business and wasn't altered after it was issued.

Unlike a handwritten signature, you don't apply the CSD yourself: your invoicing software or your Authorized Certification Provider (PAC) applies it automatically the moment you generate each invoice.

What the Digital Seal Certificate Does and How It Signs Your CFDI

Every time you invoice, your system builds the CFDI's XML with the transaction data (issuer, recipient, line items, taxes) and applies the digital seal using your CSD. That seal is a unique string generated from the exact content of the invoice: if a single digit in the XML changes after it's sealed, the seal no longer matches and the document becomes invalid.

The PAC verifies that seal before stamping the CFDI and assigning it a fiscal folio (UUID). That's why the CSD is the piece that connects your invoicing to actual tax validity: without it, there's technically no way for an invoice to go from "draft" to a document the SAT recognizes as fiscally valid. If you want a refresher on the full structure of an electronic invoice before diving into the seal itself, our guide on what a CFDI is covers the rest of the process.

CSD vs. e.firma: What's the Difference?

It's easy to confuse the CSD with the e.firma (formerly FIEL), since both are certificates issued by the SAT and both rely on public-key cryptography. But they serve different purposes:

The e.firma identifies you to the SAT and other government agencies: you use it to file returns, complete online procedures, sign legal documents, and — specifically — to request your CSD.
The CSD does exactly one thing: seal CFDI invoices. You can't use it to log into the SAT portal, file a return, or sign a contract.

Another practical difference: you can have several active CSDs at the same time (one per branch or per invoicing system, for example), while the e.firma is unique per taxpayer. And you need a valid e.firma to request or renew any CSD in the first place — without it, the process doesn't even start. If you want to go deeper on how the e.firma works on its own, we cover it in our guide on what the e.firma is.

What You Need Before Requesting a CSD

Before starting the process, make sure you have:

A valid e.firma, with its .cer and .key files and the private key's password.
An active RFC (tax ID) with the SAT, with no prior restriction that blocks the request.
The Certifica app, which the SAT distributes free through its portal to generate the request.
A new password to protect the CSD's private key (different from your e.firma's password).
Access to the SAT portal with your RFC and password, or your e.firma, to upload the request.

If your business is still putting its full invoicing process together, it's worth checking what other requirements to invoice you need beyond the CSD, since the seal is just one piece of the tax file.

How to Request a CSD with Certifica, Step by Step

The SAT replaced earlier versions of its certificate-generation tool with Certifica, the official, free app for creating your CSD request. In general terms, the process looks like this:

Download Certifica from the SAT portal and install it on your computer.
Open the app and load your valid e.firma files (.cer and .key) so the system can confirm your identity.
Set a new password for the private key of the CSD you're about to generate.
Certifica creates two files: your certificate request and the CSD's private key.
Log into the SAT portal, find the CSD request option, and upload the request file you just generated.
The SAT validates the request and, if everything checks out, makes your certificate available for download — usually within a few hours.
Download your .cer file and store it alongside your .key file and password: those three elements are what your invoicing system needs to start stamping.

Once you have your CSD, the usual next step is loading it directly into the platform or system you use to issue CFDI, so the sealing happens automatically on every sale.

Digital Seal Certificate Validity and Renewal

A digital seal certificate is valid for four years from its issue date. As that deadline approaches, the SAT lets you renew it from the same portal, through a process very similar to the initial request via Certifica, as long as your e.firma is also still valid.

It's best to start renewal at least 30 days ahead of expiration. An expired CSD means your system suddenly can't seal or stamp invoices anymore, which halts invoicing across the entire business — especially costly if you invoice multiple times a day or rely on an automated flow.

When the SAT Can Restrict or Cancel Your CSD

Article 17-H Bis of Mexico's Federal Tax Code (Código Fiscal de la Federación) gives the SAT authority to temporarily restrict a CSD, even before it expires, when it detects certain irregularities. Some of the most common causes include:

Failing to file annual returns, or two or more provisional or definitive returns.
Not being locatable at the tax address registered with the SAT.
The SAT detecting a discrepancy between declared income and what your own CFDI, bank statements, or other information on file show.
Issuing invoices that back nonexistent transactions, without having disproven that presumption.

If your CSD gets restricted, you can file a clarification request with the SAT to disprove or fix the irregularity, within the deadline the authority sets after notifying you. While the restriction is active, you can't stamp new invoices, so addressing the clarification quickly is the only way to get invoicing back up and running.

How a Solid Invoicing Process Prevents CSD Problems

Most CSD headaches don't come from the certificate itself — they come from poorly integrated invoicing processes: systems that don't warn you when a certificate is about to expire, teams that lose the .key file or its password, or businesses that only find out about an SAT restriction once a client complains their invoice never arrived.

A well-configured invoicing system manages the CSD's lifecycle as part of the process — expiration alerts, secure backup of the files, and automated stamping connected to the PAC — instead of leaving it as a manual task someone remembers once a year.

Frequently Asked Questions

What happens if my CSD expires and I don't renew it in time?

Your system stops being able to seal and stamp CFDI invoices until you renew the certificate, which halts your electronic invoicing entirely until a valid CSD is loaded into your platform.

Can I use the same e.firma to request the CSD for multiple companies?

No. Each e.firma corresponds to a specific RFC, and you can only use it to request the CSD for that same taxpayer with the SAT.

Do the CSD and the e.firma have the same validity period?

Not necessarily on the same dates; both certificates are valid for four years, but each is issued and renewed separately, so they can expire at different times.

Can I have more than one active CSD at the same time?

Yes. Unlike the e.firma, which is unique, you can generate and keep several active CSDs — for example, one per branch, point of sale, or invoicing system.

What do I need to generate my CSD besides the e.firma?

You need the SAT's Certifica app, an active RFC, and a new password to protect the certificate's private key; with those three plus a valid e.firma, you can complete the request.

If your business invoices multiple times a day and you want to stop worrying about CSD expirations, manual stamping, or sealing errors, at AISDC we build CFDI invoicing automation that manages your certificate's full lifecycle and connects directly to your operation.