To send an electronic document with an EDS securely, first determine exactly what the recipient requires: a signed document, a public certificate, or an action in an information system. Do not send the private key file and its password to another person. To confirm the signature, provide the electronic document that has already been signed and, if required by the verification procedure, the public certificate. Sign reports, e-invoices, and other forms in the relevant information system using the signatory's account and authority.
What can be sent instead of the private key
In practice, the phrase “send an EDS” may refer to different actions. It is important for an accountant to distinguish between providing a public certificate, sending a signed document, and granting a user access to an information system.
Without transferring the private key, you can:
send a document that has already been signed with an EDS;
provide the public certificate if it is required to verify the signature;
add the accountant or another employee to the information system as a separate user;
assign authority to the user using the method provided by the system;
send the prepared form to the authorized signatory for review and signing.
Transferring the private key file together with its password creates a risk that the EDS may be used without the direct involvement of its owner. For work-related operations, it is safer to create a separate account for the employee, assign the authority available in the system, and leave the signing to the person who owns the certificate.
A file that has already been signed can be forwarded through corporate email, an electronic document management system, or the account of the relevant information system. Before sending it, check the file name and format, the presence of the signature, and the recipient. Do not attach the container in which the private key is stored to an email or message.
How an accountant should sign and send a document
The procedure depends on the information system in which the document was prepared. First, log in using the account of the signatory or of a user who has been assigned the necessary authority. Then open the prepared form and check its details before signing.
Before signing, check the following in sequence:
whether the correct organization has been selected;
whether the IIN or BIN matches the account details and the selected certificate;
whether the required fields of the form have been completed;
whether the certificate has expired;
whether the user has been assigned the necessary authority in this system;
whether a previously saved certificate was selected after the EDS was reissued.
After checking, select the signing command provided by the system, specify the current certificate, and enter the password in the signing window. Then submit the document and check the result. After signing, separately check the document's status in the system: signing and acceptance of the document are displayed as separate stages of the operation. Save the displayed registration or acceptance status or the error message.
If the form was prepared by another employee, they may send it to the signatory for review within the system being used or by an agreed work-related method. The signatory reviews the document, signs it with their EDS, and checks the submission result. This procedure keeps employee access separate and makes it possible to identify which account was used when working with the document.
Why the EDS does not work when sending
After a certificate is reissued, the information system, browser, or accounting software may continue to offer the previously selected certificate. In this case, select the current certificate again and check the account settings. If the software provides for linking a certificate to a user, update the link using the software's tools.
If a message appears stating that the IIN does not match the certificate data, compare the IIN in the selected certificate with the IIN of the user whose account was used to log in. When working with an organization's documents, also check the BIN of the selected organization, whether the user belongs to it, and the authority assigned to the user. After the EDS is reissued, make sure that the system is using the new certificate rather than the saved data of the previous one.
If an e-invoice cannot be signed or sent, first save the full text of the message and note the stage at which the error appeared. Then save the draft, log out of the system, close unnecessary tabs, log in again using the current certificate, and repeat the operation. Clear browser data only as a separate technical step after saving the draft or exporting the data required to restore it.
A sending error may relate to the certificate, form, account, or connection to the system. If the message concerns incomplete required fields, correct the document; if it concerns insufficient authority, check the user's role; and if it concerns the certificate, check the selected EDS and its validity period. Analyze the error based on its full text and the stage at which the operation stopped.
What to do after replacing the key
After the EDS is reissued, save the new key in the selected secure location and check the systems in which the previous certificate was used: reporting accounts, the E-Invoice IS, and the accounting software. Distinguish between the old and new certificates by their validity periods and owner details, not merely by their file names.
In the E-Invoice IS, check the user's login, the selected organization, and the authority available to the user. If the accountant works under a separate employee account, check that this account belongs to the required organization. When the user or registration details change, update the account and its link to the current certificate using the procedure provided by the system interface.
If submission is performed from 1C, determine the stage at which the error occurs: certificate selection, password entry, signing, authorization, or document transmission. Record the full text of the message and check the settings for that specific stage. The location of commands depends on the configuration, release, and database settings, so refer to the interface of the installed configuration and its built-in help.
If the private key file and password have already been transferred to another person, stop using this key for new operations. Follow the certificate revocation procedure established by the certification authority that issued it and obtain a new certificate. After that, check the transaction history in the information systems where this EDS was used and configure them to work with the new certificate.
Frequently asked questions
Can an EDS file be sent to an accountant via a messenger? — Do not send the private key and its password via a messenger. Create separate access for the accountant with the necessary authority, and send the document to the signatory for review and signing.
What should be sent to a counterparty for signature verification? — Provide the signed electronic document. If the verification procedure requires the public certificate to be provided separately, attach it as well. The private key file and password are not required to verify the signature.
Why can an e-invoice not be sent after the EDS is replaced? — Check which certificate is actually selected, whether the account corresponds to the user, whether the correct organization is selected, and whether the necessary authority has been assigned. If the software stores a certificate link, replace the previous data with the current data.
What does an error stating that the IIN does not match the certificate mean? — Compare the IIN in the certificate with the IIN of the user of the current account. Also check the selected organization, BIN, and certificate, especially if the EDS was recently reissued.
Does a sending error always mean there is a problem with the EDS? — No. The message may relate to required form fields, the user's authority, the selected organization, the status of the information system, or the connection. Refer to the full error text and the stage at which it appeared.
Sources
Law of the Republic of Kazakhstan “On Electronic Documents and Electronic Digital Signatures”
Digital Code of the Republic of Kazakhstan
NCA RK: delegation of authority to employees
NCA RK: security of EDS keys