Digital Signature
Overview
Digital signing is provider-side. BANA never holds certificates and never runs PKCS#11 / USB-token / HSM operations, nor builds PKCS#7 or XMLDSig structures. The merchant's CA certificate and the signature are managed entirely by VNPAY (viiAPI).
@nx/invoice only requests signing by setting config-driven boolean flags in the JSON issuance payload built by _buildInvoiceRequest. The provider performs the actual signing, release and tax-authority submission.
What @nx/invoice Does
| Concern | Owner |
|---|---|
| Certificate storage, PKCS#11 / USB token / HSM | VNPAY (provider) |
| XML signing (PKCS#7 / XMLDSig) | VNPAY (provider) |
| Signing request | @nx/invoice sets flags in _buildInvoiceRequest payload |
Signing Flags
Set from TInvoiceProviderConfig (all optional) in the issuance request:
| Flag | Source | Effect (provider-side) |
|---|---|---|
autoSign | config.autoSign | VNPAY signs the invoice with the merchant's CA certificate |
autoRelease | config.autoRelease | VNPAY releases / issues the invoice after signing |
autoSendCQT | config.autoSendCqt | VNPAY sends the signed invoice to the tax authority (CQT) |