Problem communicating with eSocial webservice

Question

I have the following problem when communicating with eSocial webservice, I am using C# so I added the reference of the webservice in my project and now I need to send an XML, and what I thought was: to establish a secure connection, before I should define a certificate, and open the connection, and then send the XML. For that I did as follows:

// Crio a variavel de envio de lote
ServicoEnviarLoteEventosClient enviarLote = new ServicoEnviarLoteEventosClient();

I have a small code snippet that searches for the certificate in question on my local computer and arrow it into this variable as follows:

enviarLote.ClientCredentials.ClientCertificate.SetCertificate(
                 x509.SubjectName.Name, store.Location, StoreName.My);

I open the connection:

enviarLote.Open();

Then I try to send:

var resposta = enviarLote.EnviarLoteEventos(System.Xml.Linq.XElement.Load(caminhoXML)); 

However when trying an error is returned: Could not establish trust relationship for the SSL/TLS secure channel with authority

I have also installed the certificate chain provided by eSocial....

Can someone help me ? In case anyone has doubts about the XML signature I can help...

Answer 1

Thank you for the reference to my examples page, Leo!

I also created a long time ago a page with tips on how to access the eSocial service, including some of the ones you posted in your question and answer. I will take the subject of your question to put these tips here, to help anyone with similar problems.

To access the eSocial sending service, in the Restricted Production environment, the URL must be this:

https://webservices.producaorestrita.esocial.gov.br/servicos/empregador/enviarloteeventos/WsEnviarLoteEventos.svc

In addition, according to eSocial Developer Guidance Manual v1.6.3, page 83, item '7.9. Digital certification', it is also necessary to install on the machine that will access the service to Chain of Certificates issued on 02/06/2017 by Serpro, which are 3 certificates that can be obtained at this address:

https://certificados.serpro.gov.br/serproacf/certificate-chain

According to item 02.03 from the eSocial Portal FAQ page, the certificates must be installed in the order they are displayed on this Serpro page, and:
The Brazilian Root Certification Authority v5 must be installed in the root AC repository. The SERPRO v4 Certification Authority and SERPRO Final v5 Certification Authority shall be installed in the intermediate AC repository.

Remembering that it is also necessary to have installed on the computer that will access the web service a valid digital certificate (A1 or A3, e-CNPJ or e-CPF), which must be used to access the service. A tip: When I started tests with eSocial, I spent almost a week banging my head to get the first access, when I finally discovered that in my case (e-CNPJ A1), it was necessary to select the option Mark this key as exportable (Mark this key as Exportable) and install my certificate in the repository (store) Personal (Personal), of Current User (Current User).

Regarding the code used to access the service, the Binding service (I used BasicHttpBinding or BasicHttpsBinding) must be configured to use Securitymode = Transport (for the HTTPS) and Clientcredentialtype = Certificate (to specify a certificate), more or less so:

 var urlServicoEnvio = @"https://webservices.producaorestrita.esocial.gov.br/servicos/empregador/enviarloteeventos/WsEnviarLoteEventos.svc";
 var address = new EndpointAddress(urlServicoEnvio);
 var binding = new BasicHttpsBinding();  //Disponível desde .NET Framework 4.5
 // ou:
 //var binding = new BasicHttpBinding(BasicHttpsSecurityMode.Transport);
 binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.Certificate;

 var wsClient = new WsEnviar.ServicoEnviarLoteEventosClient(binding, address);
 wsClient.ClientCredentials.ClientCertificate.Certificate = x509Cert;

 var retornoEnvioXElement = wsClient.EnviarLoteEventos(loteEventosXDoc.Root);
 wsClient.Close();

As for class WsEnviar.ServicoEnviarLoteEventosClient used in the code, it was created by Visual Studio when adding a Service Reference, using the same service URL, but adding the parameter ?singleWsdl:

https://webservices.producaorestrita.esocial.gov.br/servicos/empregador/enviarloteeventos/WsEnviarLoteEventos.svc?singleWsdl

In VS it is also possible to add a reference to the service directly using the file Wsenviar loteeventos-v1_1_0.wsdl made available on eSocial Communication Package (latest version 1.4.1), which can be found on the eSocial Portal technical documentation page.

That tool, Add Service Reference of VS, will create a client class to consume the web service, in the case of the example WsEnviar.ServicoEnviarLoteEventosClient, who inherits the class System.ServiceModel.Clientbase.

It is also possible to use the command line tool svcutil.exe, which, likewise, will create a client class inheriting the class System.ServiceModel.Clientbase. Alternatively it is also possible to use the command line tool wsdl.exe, older, for services from the time of . NET Framework 2, based on ASMX, which will also create a client class, but this time inheriting the class System.Web.Services.Protocols.Soaphttpclientprotocol. But in that case the code to consume the service would be a little different.

Following all these steps, accessing the eSocial web service should work.

Answer 2

To solve the problem of secure connection, it is necessary to install the government certificate chain on:

Autoridades de Certificação Raiz Confiáveis

Remember, for each certificate make sure to put in this folder as I had forgotten.

To Download the Certificate Chain access:

https://certificados.serpro.gov.br/serproacf/certificate-chain

The code structure that I informed above is correct, the sending will be performed if the XML is structured correctly, for valid XML examples access:

http://suporte.quarta.com.br/eSocial/ExemplosEventosXml.htm

I hope I’ve worked with someone!