# XV-SA-02

Source: https://xmlvalid.com/rules/XV-SA-02

> The signature (ds:SignatureValue) does not verify with the public key of the certificate in the signature over the invoice hash it states.

- Level: error
- Rule sets: ZATCA cryptographic stamp and QR code checks Security Features Implementation Standards 1.1, SDK 3.4.6
- Context: `/*[ext:UBLExtensions//ds:Signature]`
- Test: `not($reference and $value and $certificate) or js:xvEcdsaVerify($stated, $value, $certificate) ne 'invalid'`

## Why it fails

- The certificate in `ds:X509Certificate` is not the one whose private key signed: often the SDK's sample certificate left in place of the one ZATCA issued for the EGS unit.
- The signature was made over the hash's Base64 text or hex instead of the 32 bytes of the hash.

Validate a document against these rules: https://xmlvalid.com/validate