eSocialBX: Invalid signature error

Question

I am trying to consume the Event Identifiers Query Webservice. But I get this return from the Recipe:

<eSocial
xmlns="http://www.esocial.gov.br/schema/consulta/identificadores-eventos/retorno/v1_0_0">
<retornoConsultaIdentificadoresEvts>
    <status>
        <cdResposta>142</cdResposta>
        <descResposta>Assinatura do evento inválida. Padrão de assinatura não reconhecido.</descResposta>
    </status>
</retornoConsultaIdentificadoresEvts>

This is the xml that is sending:

<s:Envelope
xmlns:s="http://schemas.xmlsoap.org/soap/envelope/">
<s:Body>
    <ConsultarIdentificadoresEventosEmpregador
        xmlns="http://www.esocial.gov.br/servicos/empregador/consulta/identificadores-eventos/v1_0_0"
        xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
        <consultaEventosEmpregador>
            <eSocial
                xmlns="http://www.esocial.gov.br/schema/consulta/identificadores-eventos/empregador/v1_0_0"
                xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                xmlns:xsd="http://www.w3.org/2001/XMLSchema">
                <consultaIdentificadoresEvts>
                    <ideEmpregador>
                        <tpInsc>1</tpInsc>
                        <nrInsc>00000000000100</nrInsc>
                    </ideEmpregador>
                    <consultaEvtsEmpregador>
                        <tpEvt>S-1250</tpEvt>
                        <perApur>2018-12</perApur>
                    </consultaEvtsEmpregador>
                </consultaIdentificadoresEvts>
                <Signature
                    xmlns="http://www.w3.org/2000/09/xmldsig#">
                    <SignedInfo>
                        <CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>
                        <SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
                        <Reference URI="">
                            <Transforms>
                                <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
                                <Transform Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>
                            </Transforms>
                            <DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
                            <DigestValue>l6K5QTBqOn2R5OVwfyjAQn2tcY2KLt+/WwQleOZ+yCQ=</DigestValue>
                        </Reference>
                    </SignedInfo>
                    <SignatureValue>[...]</SignatureValue>
                    <KeyInfo>
                        <X509Data>
                            <X509Certificate>[...]</X509Certificate>
                        </X509Data>
                    </KeyInfo>
                </Signature>
            </eSocial>
        </consultaEventosEmpregador>
    </ConsultarIdentificadoresEventosEmpregador>
</s:Body>

This is the code, as it is only for testing the certificate is fixed:

public static void ConsultarIdentificadoresEventosEmpregador()
{
    ServicoConsultarIdentificadoresEventosClient client = new ServicoConsultarIdentificadoresEventosClient();
    eSocial esocial = new eSocial();
    esocial.consultaIdentificadoresEvts = new eSocialConsultaIdentificadoresEvts();
    esocial.consultaIdentificadoresEvts.ideEmpregador = new TIdeEmpregador();
    esocial.consultaIdentificadoresEvts.ideEmpregador.tpInsc = 1;
    esocial.consultaIdentificadoresEvts.ideEmpregador.nrInsc = "00000000000100";
    esocial.consultaIdentificadoresEvts.consultaEvtsEmpregador = new TConsultaEventosEmpregador();
    esocial.consultaIdentificadoresEvts.consultaEvtsEmpregador.perApur = "2018-12";
    esocial.consultaIdentificadoresEvts.consultaEvtsEmpregador.tpEvt = "S-1250";

    X509Store store = new X509Store(StoreName.My, StoreLocation.LocalMachine);
    store.Open(OpenFlags.ReadOnly);
    certificado = store.Certificates[7];

    var xml = Serialize(esocial);

    client.ClientCredentials.ClientCertificate.Certificate = certificado;
    SignXmlDoc(xml, certificado);

    var retorno = client.ConsultarIdentificadoresEventosEmpregador(xml.DocumentElement);
    client.Close();
}

And the signature code, I’ve tried it in many ways, even now it’s identical to that answer: Esocial - Error signing XML.

I used tools like xsd.exe and svcutil.exe for code generation.

Answer 1

I don’t know exactly what was the cause of the error but I can visualize some problems that may or may not be the cause of this error, I will list them.

1. Element namespace eSocial in XML

The root element eSocial must contain the specific eSocial namespace for that event, but must not contain the attributes xmlns:xsi and xmlns:xsd, which are normally automatically inserted by the serializer. See item 3 of that answer: EFD Reinf v1_04_00 - How to instantiate and populate all Event properties? - Stack Overflow, that has an example code to serialize XML without these attributes.

2. SOAP elements in XML

In your XML example there are elements of SOAP, such as <s:Envelope> and <s:Body>, that should not be there, because . NET will take charge of taking your XML and putting in a SOAP envelope to send to the service. In addition XML has the element <ConsultarIdentificadoresEventosEmpregador> before the <eSocial>, and it shouldn’t be there in XML either. The element <eSocial> must be the root of the document.

3. Wrong method

You are using the wrong method to call the service! From what I understand, you want to consult the event S-1250 (Acquisition of Rural Production), that is part of the Periodic Events, so in this case you should use the method ConsultarIdentificadoresEventosTrabalhador, instead of the method ConsultarIdentificadoresEventosEmpregador.

See the description of the methods in Developer’s Guidance Manual eSocial version 1.7, from page 58:

5.6.2.1. Method ConsultarIdentificadoresEventosEmpregador
The method consultarIdentificadoresEventosEmpregador allows consultation of employer event identifiers that do not fit the event categories table or periodic and non-periodical events of the worker.

5.6.2.2. Method ConsultarIdentificadoresEventosTabela
The method consultarIdentificadoresEventosTabela allows consultation of employer table event identifiers.

5.6.2.3. Method ConsultarIdentificadoresEventosTrabalhador
The method consultarIdentificadoresEventosTrabalhador allows consultation of periodic and non-periodical events of the worker linked to the employer.

By my understanding, the first method ConsultarIdentificadoresEventosEmpregador, which is what you tried to use, would only be used to retrieve information sent by the S-1000 event, although this information is very confusing looking at the XSD documentation and schematics, since in the examples of the method manual ConsultarIdentificadoresEventosTabela there is an example referring precisely to the S-1000 event, and in the scheme of the method ConsultarIdentificadoresEventosEmpregador there is the element tpEvt, although he theoretically should only accept the S-1000.

4. eSocial bug

I confess that I have not yet tested this consultation, but I know that it is still very problematic. I participate in the forum on eSocial Fenainfo (via email) and until recently the few people who had tried said that the service only worked in the Restricted Production environment and in the Production environment (official) if I am not mistaken I gave exactly this invalid signature error.

If this is your case, I advise you to send a message in the area of contact eSocial Production environment, to report the problem.

---

Example of XML

An example of how your XML would look, before signing:

<?xml version="1.0" encoding="utf-8"?>
<eSocial xmlns="http://www.esocial.gov.br/schema/consulta/identificadores-eventos/trabalhador/v1_0_0">
  <consultaIdentificadoresEvts>
    <ideEmpregador>
      <tpInsc>1</tpInsc>
      <nrInsc>12345678</nrInsc>
    </ideEmpregador>
    <consultaEvtsTrabalhador>
      <cpfTrab>12345678901</cpfTrab>
      <dtIni>2019-01-01T00:00:00</dtIni>
      <dtFim>2019-01-31T00:00:00</dtFim>
    </consultaEvtsTrabalhador>
  </consultaIdentificadoresEvts>
</eSocial>

And after signing:

<?xml version="1.0" encoding="utf-8"?>
<eSocial xmlns="http://www.esocial.gov.br/schema/consulta/identificadores-eventos/trabalhador/v1_0_0">
  <consultaIdentificadoresEvts>
    <ideEmpregador>
      <tpInsc>1</tpInsc>
      <nrInsc>12345678</nrInsc>
    </ideEmpregador>
    <consultaEvtsTrabalhador>
      <cpfTrab>12345678901</cpfTrab>
      <dtIni>2019-01-01T00:00:00</dtIni>
      <dtFim>2019-01-31T00:00:00</dtFim>
    </consultaEvtsTrabalhador>
  </consultaIdentificadoresEvts>
  <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
    <SignedInfo>
      <CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" />
      <SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
      <Reference URI="">
        <Transforms>
          <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
          <Transform Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" />
        </Transforms>
        <DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
        <DigestValue>[...]</DigestValue>
      </Reference>
    </SignedInfo>
    <SignatureValue>[...]</SignatureValue>
    <KeyInfo>
      <X509Data>
        <X509Certificate>[...]</X509Certificate>
      </X509Data>
    </KeyInfo>
  </Signature>
</eSocial>

Yes, the correct method ConsultarIdentificadoresEventosTrabalhador does not have a field to specify the type of event you want to query, which leads me to believe that you will receive all events of that CPF, within the specified period, and will need to identify them with the ID of the event that is returned.

Other considerations

It is also good to remember the restrictions of the service, which are listed on pages 57 and 58 of the same manual:

• Consultations may not be held between days 1 to 7 of each month.
• Each employer can only perform one consultation at a time, that is, no parallelism will be allowed on this Webservice.
• Each employer can make a maximum of 10 accesses per day to Webservices described in the sections 5.6 - Event Identifiers Query Web Service and 5.7 - Events Download Request Website, that is, the sum of the access to the above mentioned Webservices should not exceed 10 per day.
• The query should be performed with a deadline of one hour unless the current date.
• The returns of the queries will contain the received events up to one hour unless the current date.

Also information I got in the Fenainfo forum is that eSocialBX that has been released (is the name of the product that allows the consultation and download of events previously sent to eSocial) is a Surgical eSocialBX, which has been released emergentially only for point recovery of certain receipts (so it still has so many restrictions).

The whole service, which seems to be called eSocialBX Data Lake, is still without exact forecast of release by the government, and by all indications will be a service charged.