oxpki

Rust engine for SAT Certifica-compatible artifacts.

The Rust engine is the primary implementation. The original Go implementation is preserved on the oxpki-go branch as historical reference.

Compatibility status

Confirmed:

• Rust-generated FIEL renewal .ren accepted by SAT.
• Rust-generated renewal .key matches the issued active e.firma certificate.
• Rust-generated CSD .sdg accepted by SAT.
• Rust-generated CSD .key matches the issued active CSD certificate.
• Rust can inspect X.509 certificates and validate .cer / .key pairs.

Public proof metadata is recorded in fixtures/proof/. Real SAT certificates, private keys, passwords, and taxpayer identity material are intentionally not committed.

Pending:

• Initial FIEL .req acceptance proof.
• Moral person fixture.
• Multi-branch CSD fixture.
• Golden comparison against official Certifica output.

Repository layout

crates/
  oxpki-core/   SAT-compatible engine
  oxc/          CLI wrapper
  oxpki-wasm/   browser wrapper
fixtures/       redacted proof metadata and local fixture guidance
spec/           artifact protocol notes

Checks

cargo fmt --check
cargo test
cargo clippy --all-targets -- -D warnings
cargo check --target wasm32-unknown-unknown -p oxpki-wasm

Rust crate

oxpki-core = "0.1.0-alpha.3"

CLI

cargo run -p oxc -- inspect --cert path\to\certificate.cer
cargo run -p oxc -- pair-check --cert path\to\certificate.cer --key path\to\private.key --password-file path\to\password.txt

Generate a CSD stack signed by a valid FIEL:

cargo run -p oxc -- generate-csd --rfc RFC --serial-number CURP --name "LEGAL NAME" --unit "BRANCH" --signer-cert fiel.cer --signer-key fiel.key --signer-password-file signer-pass.txt --new-password-file new-pass.txt --out out-dir

For physical-person CSD, --name is the taxpayer legal name and --unit is the branch / sucursal. Passing the branch as both values is known to be rejected by SAT.

WASM

npm install @oxhq/oxpki-wasm@alpha

oxpki-wasm exposes the same local workflows for browser callers:

• inspectCertificate
• pairCheck
• renewFiel
• generateCsd

It does not add storage, upload, or server behavior. Browser apps are expected to keep .key material local.