ICP-Brasil A1 Certificates Explained: Why Brazilian E-Invoicing (NF-e and NFS-e) Depends on Them
Global E-Invoicing Platform Series
This guide is part of a comprehensive series. Explore all 36 topics:
An ICP-Brasil A1 certificate is the software-resident digital identity that Brazilian taxpayers use to sign every NF-e (goods) and NFS-e (services) invoice before transmission to SEFAZ. It is issued by an ITI-accredited Autoridade Certificadora, bound to a CNPJ, valid for one year, and loaded into the invoicing platform's key store to sign the canonicalised XML payload using XML-DSig (XAdES profile). Without an active A1 (or the hardware-resident A3 equivalent), SEFAZ rejects every payload and all NF-e / NFS-e issuance stops.
At a glance
- Governance: ICP-Brasil (Infraestrutura de Chaves Públicas Brasileira), regulated by ITI (Instituto Nacional de Tecnologia da Informação).
- Legal hook: MP 2.200-2/2001 — establishes ICP-Brasil signatures as legally equivalent to handwritten signatures.
- Format A1: Software-resident certificate (.pfx / .p12), 1-year validity.
- Format A3: Hardware-resident certificate (smart card / USB token), up to 3-year validity.
- Bound to: A specific CNPJ (legal entity).
- Issued by: ITI-accredited Autoridades Certificadoras (Serasa, Serpro, Soluti, Certisign, AC Safeweb, Valid, others).
- Signing format: XML-DSig with the Brazilian XAdES profile.
- Last reviewed: 20 November 2026.
Where ICP-Brasil sits in the global e-invoicing landscape
The ICP-Brasil A1 certificate is conceptually identical to ZATCA's CSID in Saudi Arabia or the FIRS-issued signing credential in Nigeria: a national-PKI-rooted, taxpayer-bound credential without which the clearance regime rejects the payload.
The ICP-Brasil A1 certificate is conceptually identical to ZATCA's CSID in Saudi Arabia or the FIRS-issued signing credential in Nigeria: a national-PKI-rooted, taxpayer-bound credential without which the clearance regime rejects the payload. Brazil's distinguishing trait is the depth and age of the AC market (over 20 years of ICP-Brasil-accredited issuers) and the bifurcation into A1 (software) and A3 (hardware) profiles.
What ICP-Brasil is
ICP-Brasil is Brazil's national public-key infrastructure, governed by ITI under MP 2. 200-2/2001.
ICP-Brasil is Brazil's national public-key infrastructure, governed by ITI under MP 2.200-2/2001. Every digital signature with legal validity in Brazil — for fiscal documents, contracts, notarial acts, government submissions — chains back to an ICP-Brasil root. The Brazilian e-invoicing regimes (SEFAZ NF-e for goods, NFS-e for services) make the ICP-Brasil signature mandatory at issuance.
A1 vs A3 certificates
For SEFAZ NF-e and NFS-e issued through cloud invoicing software, A1 is the standard choice — the certificate is loaded into the platform's HSM-backed key store and used to sign every payload programmatically. A3 makes sense when a named legal officer signs manually (notarial flows, sworn declarations).
| Attribute | A1 | A3 |
|---|---|---|
| Storage | Software file (.pfx / .p12) | Smart card or USB token |
| Validity | 1 year | Up to 3 years |
| Issuance cost | Lower | Higher (includes hardware) |
| Server-side signing | Native fit — load into HSM-backed key store | Awkward — requires PKCS#11 + physical reader |
| Best for | Cloud invoicing platforms, headless integrations | Manual signing by a named officer |
For SEFAZ NF-e and NFS-e issued through cloud invoicing software, A1 is the standard choice — the certificate is loaded into the platform's HSM-backed key store and used to sign every payload programmatically. A3 makes sense when a named legal officer signs manually (notarial flows, sworn declarations).
How an A1 certificate is issued
Choose an ITI-accredited Autoridade Certificadora (AC) — Serasa, Serpro, Soluti, AC Certisign, AC Safeweb, Valid, and others on the ITI register. The AC validates the legal entity's identity in person or via approved videoconference.
- Choose an ITI-accredited Autoridade Certificadora (AC) — Serasa, Serpro, Soluti, AC Certisign, AC Safeweb, Valid, and others on the ITI register.
- The AC validates the legal entity's identity in person or via approved videoconference. The identity check is strict to maintain the chain of trust.
- The AC issues the A1 certificate file bound to the legal entity's CNPJ, with a passphrase.
- The certificate is loaded into the invoicing platform's key store; the passphrase is sealed in a vault.
How an A1 signs an NF-e
The invoicing platform builds the NF-e XML according to the SEFAZ schema for the relevant state. The platform canonicalises the XML.
- The invoicing platform builds the NF-e XML according to the SEFAZ schema for the relevant state.
- The platform canonicalises the XML.
- It computes a hash over the canonicalised XML.
- The A1 private key signs the hash using XML-DSig (the Brazilian XAdES profile).
- The signed NF-e is transmitted to the SEFAZ webservice for the issuing state.
- SEFAZ verifies the signature, validates the payload, and returns an authorisation protocol with the chave de acesso — the 44-digit access key that becomes the invoice's national identifier.
Renewal and rotation
A1 certificates expire annually.
A1 certificates expire annually. Operationally:
- Set an expiry alert at least 30 days ahead. Invoicemonk raises a banner on every login as expiry approaches.
- Renew through the same AC (or a different one — your choice). Identity validation is required again at renewal.
- Load the new certificate into the platform before the old one expires; an expired A1 means SEFAZ rejects every payload, blocking all NF-e and NFS-e issuance.
- Archive the expired certificate for the statutory retention period (five years for fiscal documents).
Where else this matters
The ICP-Brasil model — a national-PKI-rooted signing credential bound to the taxpayer's identity — parallels the ZATCA CSID in Saudi Arabia, the FIRS Nigeria signing credential, and the LHDN-onboarded certificate in MyInvois Malaysia.
The ICP-Brasil model — a national-PKI-rooted signing credential bound to the taxpayer's identity — parallels the ZATCA CSID in Saudi Arabia, the FIRS Nigeria signing credential, and the LHDN-onboarded certificate in MyInvois Malaysia. The signing format (XML-DSig with XAdES profile) is the same family used by ZATCA Phase 2 and the EU EN 16931 standard.
Authority sources
- ITI — Instituto Nacional de Tecnologia da Informação (ICP-Brasil regulator)
- ITI — ICP-Brasil official page
- Medida Provisória 2.200-2/2001 — legal basis for ICP-Brasil signatures
- Portal NF-e — SEFAZ NF-e national portal
- ITI — ICP-Brasil legislation and AC list
- W3C — XML Signature Syntax and Processing (XML-DSig spec)
TL;DR
A1 is the software-resident, CNPJ-bound, AC-issued, 1-year ICP-Brasil certificate that signs every Brazilian e-invoice before SEFAZ. Without it, nothing ships.
A1 is the software-resident, CNPJ-bound, AC-issued, 1-year ICP-Brasil certificate that signs every Brazilian e-invoice before SEFAZ. Without it, nothing ships. Renew before expiry, keep the passphrase in a vault, and treat the rotation calendar as critical infrastructure — not as IT housekeeping.
Related reading
Related reading includes: SEFAZ Brazil — Invoicemonk's NF-e and NFS-e implementation What is a CSID?
More in this series (36 articles)
From this series
Mandate-compliant e-invoicing in 17 jurisdictions, with the local artefact (CSID, IRN, UUID, QR, digital signature) issued automatically.
Digital Marketing, SEO Specialist, Content Creator & Product Professional
Olayinka is a digital marketer, content creator, growth and SEO specialist with 10+ years helping businesses in Nigeria, the UK, the US, Australia, and Dubai achieve their goals online.
