DS322
Document digest value doesn't match digest calculated value from existing document content. Document content might have changed: the signature states …, the document's digest is … (… with the whitespace between elements).
error: the document is invalid
Why it fails
- The document was edited after it was signed: an amount, a date or a line added by a later step of the integration.
- The digest was taken over the document as written, not without
ext:UBLExtensionsandcac:Signature, or not canonicalized with C14N 1.1. - The signature block was copied from the SDK's sample, with the sample's digest.
How to fix it
Sign as the last step: remove ext:UBLExtensions and cac:Signature, canonicalize the rest with C14N 1.1, take its SHA-256 in Base64 as the id-doc-signed-data reference's DigestValue, and sign that digest.
What the rule checks
As the rule set's publisher wrote it. The rule runs on every element the context matches, and fails where the test is false; the validator reports the line of that element.