SanBar EXPress Fiscal Check-BR

FAQ

Which tax regimes are supported?

MEI (CRT 4) and Simples Nacional (CRT 1). The Normal regime is not checked in this version.

Does it change my products by itself?

Only the CSOSN/CFOP of products in automatic mode, following your regime. Everything else changes only when you click a fix and save.

Where do the NCM and CEST tables come from?

• NCM — the current official table, downloaded from Portal Único Siscomex (Receita Federal) and refreshed once a month.
• CEST — built from the official text of ICMS Agreement 142/2018 (CONFAZ) and shipped with the plugin.

Does the plugin modify my data on uninstall?

Only its own data: its settings and its own _sbfcbr_* product meta (per-regime profiles and check status). The standard fiscal fields of your products (NCM, CEST, CSOSN, CFOP…) are never touched on uninstall. The digital certificate (Plus edition) is not removed either: see the next question.

Where is my digital certificate kept, and what happens to it when I delete a plugin?

Plus edition. There is one A1 certificate per site, kept in the site vault (the option sanbar_certificado) and shared with SanBar EXPress NF-e & PDV. Both plugins read and write the same one:

• If the vault is empty, you can send the certificate here (⚙ Settings → GTIN search) or in NF-e & PDV. If it already has a certificate, this plugin shows it and does not offer the upload. To replace it, remove the current one first (“Remover certificado”) and send the new one.
• It is stored in the database, encrypted: the .pfx file and its password are sealed together with libsodium (authenticated encryption), using a key derived from your site’s security keys (the salts in wp-config.php). Anything altered in the database is refused. They are never shown, logged or sent anywhere except to SEFAZ in the GTIN lookup. If you change the site’s security keys the certificate can no longer be opened: the plugin says so and you send it again.
• It works with NF-e & PDV active, deactivated or not installed.
• Deleting this plugin does not remove the certificate: it stays in the vault, because NF-e & PDV may still use it and whether to remove it is your choice. To remove it, click “Remover certificado” before deleting the plugin, or remove the option sanbar_certificado (and nfbr_certificado or sbfcbr_cert, if they still exist) from the {prefix}options table of the database.
• Fiscal documents are not involved: this plugin does not store invoices. NF-e & PDV keeps those on purpose, as explained in its own readme (Ajuste SINIEF 07/05, cláusula décima; Código Tributário Nacional, art. 195, parágrafo único).

My certificate is old or the upload fails. What can I do?

Plus edition. Some older A1 certificates (.pfx) use RC2/3DES encryption that current servers (OpenSSL 3) cannot read. This plugin then tries to convert the file by itself (see the next question). If the server does not allow it, convert it on your computer and upload the new file. There is also a “?” help next to the upload with these steps:

• openssl pkcs12 -legacy -in old.pfx -nodes -out temp.pem
• openssl pkcs12 -export -in temp.pem -out new.pfx
• rm temp.pem

Run them in this order. The first asks for the old file’s password; the second asks you to choose a password for the new file (type it twice; it can be the same). temp.pem holds your private key without protection, so delete it right away (on the Windows Command Prompt use del temp.pem). If you get “unknown option -legacy”, your OpenSSL is old: remove -legacy. On Windows, Git for Windows includes OpenSSL in Git Bash. You can also ask your certificate authority to re-issue or export the A1 in the new format. Keep the original file, and never send the certificate or its password by e-mail or chat.

Does the plugin run commands on my server?

Plus edition. Only one, and only in the case above: when you upload an old-format certificate, this plugin runs the server’s openssl program (PHP exec) to re-encode the file you just sent.

• The program is looked up in fixed, standard paths; nothing from the request goes into the command, and every argument goes through escapeshellarg.
• The password is passed through a file, never on the command line.
• The four temporary files are created with permission 0600 (owner only) before any content is written, and are always deleted afterwards. One of them holds the private key unprotected, which is why this matters.
• It never runs at any other time. If exec is disabled or openssl is missing, nothing runs and you are told how to convert the file yourself.

Which libraries are bundled?

The Plus edition bundles NFePHP sped-common 5.1.17 and sped-gtin 1.1.2 (LGPL-3.0-or-later / GPL-3.0-or-later / MIT) and psr/log 3.0.2 (MIT), in plus/lib/, only to query the GTIN registry and read the certificate. If NF-e & PDV is active, its own copy of the same libraries is used instead.