How to properly sign UBL documents transmitted via AS4

[shunkica]

Hello @phax,

I have a question related to the namespace extraction issue discussed in #269, but specific to signed UBL documents.

Context: Croatian e-Invoicing AS4 Implementation

Starting January 1, 2026, Croatia is transitioning to AS4 for all B2B and B2G e-Invoice exchange.
Until now we had a separate B2G eInvoicing system (custom SOAP system, not AS4):

• UBL Invoices/Credit Notes were signed using XAdES-B-B (+ XAdES-B-T for timestamps)
• Signature was embedded in <ext:UBLExtensions><ext:UBLExtension><ext:ExtensionContent><sig:UBLDocumentSignatures><sac:SignatureInformation>
• The signature Reference used URI="" (enveloped signature covering the entire UBL document)

The Problem

The thing I do not understand is how to implement this signature properly after transitioning to AS4 where a SBD wrapper is required for the document being sent.
The validation of such a signature would fail after being wrapped with SBD, since it uses URI="".

Signing the entire SBD and putting the signature in <ext:UBLExtensions><ext:UBLExtension><ext:ExtensionContent><sig:UBLDocumentSignatures><sac:SignatureInformation> also seems like the wrong approach to me (I am not sure if that would even be spec compliant), and additionally it would not work, because the central C3 point in Croatian AS4 system, which handles incoming documents for all government entities, removes the SBD envelope and passes on only the payload (UBL Invoice or UBL CreditNote) to C4.

I understand that in PEPPOL it is not mandated to sign the UBL documents, and I am not even sure if it is mandated in the new Croatian system because of the horrible communication and specification on their part, but:
How do I ensure the integrity of the Invoice for tax and legal purposes if it is not signed using XAdES?

Without business document-level signatures, there's no cryptographic proof of:

• When the invoice was issued (the <cbc:IssueDate> is just plain data)
• Document integrity after delivery

Any guidance on how to properly implement XAdES signatures in this scenario would be greatly appreciated!

[phax]

@shunkica thanks for extracting that into a separate thread.
I think the main confusion comes from different aspects:

1. The Invoices/CreditNotes are exchanged via AS4 where the SBDH is mandatorily signed (and not the Invoice).
2. The Tax data sent to the HR government they must be signed in their native data structures and are transmitted via a custom REST implementation - so NOT using AS4.

To my understanding, using the DSS library from the EC is a good starting point to get the data signed properly: https://github.com/esig/dss

I suggest you start in the test folder from https://github.com/esig/dss/tree/master/dss-xades/src/test/java/eu/europa/esig/dss/xades/signature and search for something that works for you. Unfortunately, I haven't implemented the tax report signing yet, so I cannot provide you with more detailed guidance

[shunkica]

Thank you for your response.

However, my question was not related to the tax reporting requirements, I use my own custom built library for tax reporting.

It was specifically related to my lack of understanding how AS4 works and how I can prove the what and when was sent ( a replacement for the previous XAdES signature of the UBL Invoice ).

However as I understand now, the AS4 protocol already signs the SBD itself in a detached signature, therefore I do not need to sign the SBD or even the UBL itself, as that is handled automatically by C2.

All I need is to store the user message envelope and the signal message envelope generated by C2 and that is my proof of what and when was sent.

[phax]

Thanks for the clarification. Indeed the what and when is handled by AS4 directly.
The what is the SBDH, including the UBL. The when is handled in the AS4 UserMessage containing the date and time of the transmission.

Both the SBDH as well as the AS4 UserMessage are signed when using the HR eDelivery AS4 profile

[shunkica]

@phax The specific endpoints I am working with have, in their SMP config, this directive: <RequireBusinessLevelSignature>true</RequireBusinessLevelSignature>. So does this mean that I must sign the UBL anyway?

[phax]

That is a very good question. The MPS 1.3 specification doesn't state anything, if this field is to be valued or not. However, as the example also uses <RequireBusinessLevelSignature>true</RequireBusinessLevelSignature> I am inclined to say that it might some copy-pasting-decision ;-)
Best to ask for an official statement - sorry

[shunkica]

I have been asking for official statements about a lot of different things. Unfortunately it has fallen on deaf ears.

[phax]

Well, in Peppol this field is actually not used - especially because the AS4 transmission itself is signed anyway. So try your luck and don't add a signature on top of it and see what happens - you can invest the effort later on if absolutely needed. But to me, this is clearly something that should be stated in the specification.