--- title: "Guide \"Electronic Signature and Encryption Programs\" in \"Accounting for Kazakhstan\" 3.0: How to Configure the Cryptographic Provider for Digital Signature, Electronic Invoice (ESF), and Tax Return Form (TRF)" country: KZ lang: en author: Сапа Т.И. (https://buhgpt.kz/authors/sapa-ti) date: 2026-09-07 canonical: https://buhgpt.kz/suraqtar/spravochnik-programmy-elektronnoy-podpisi-i-shifrovaniya--en source: BuhGPT --- # Guide "Electronic Signature and Encryption Programs" in "Accounting for Kazakhstan" 3.0: How to Configure the Cryptographic Provider for Digital Signature, Electronic Invoice (ESF), and Tax Return Form (TRF) > **TL;DR:** ```html Checked on release 3.0.74.2 "Accounting for Kazakhstan" (version 3.0). You sign the electronic invoice (ESF), click "Sign and Send" — and instead of sending, you get a red window: "No electronic signature and encryption program is installed on the computer" or "Certifi --- ```html Checked on release 3.0.74.2 "Accounting for Kazakhstan" (version 3.0). You sign the electronic invoice (ESF), click "Sign and Send" — and instead of sending, you get a red window: "No electronic signature and encryption program is installed on the computer" or "Certificate program not found." The certificate from the National Certification Center of the RK is available, the key is inserted, NCALayer is running — but 1C "does not see" the cryptography. The problem is almost always here: in the directory "Electronic Signature and Encryption Programs" there is no necessary entry about your cryptographic provider or its identifier does not match what is actually installed in the system. Let's figure out how this directory is structured and how to bring it to a working state. 1. Purpose The directory stores a list of cryptographic service providers (CSP), through which 1C works with electronic signatures and encryption: what the program is called, under what identifier it is registered in Windows/Linux/macOS, and which signature, hashing, and encryption algorithms it can compute. Based on these entries, 1C selects the provider for your certificate when signing ESF, SNF, reconciliation acts, reports, and any electronic documents. This is a service (technical) directory, not an accounting document. It does not create accounting entries, does not calculate VAT, and does not generate ESF by itself — it only ensures that the signature physically works. 2. Where to find Main path: - Administration → Exchange of electronic documents (or Program settings) → Electronic signature and encryption → in the settings form, the tab/hyperlink "Programs". - Alternatively from the certificate card: Directories/Administration → Certificates of electronic signature and encryption keys → open the certificate → field "Program". Open the list directly in 1C — through "Functions for technical specialists" → "Open navigation link" (or service menu → "Go to navigation link"), inserting: e1cib/list/Directory.ElectronicSignatureAndEncryptionPrograms 2a. How to know your release Help → About the program (or the "i" icon / "Menu → Help → About the program"). In the opened window, you can see the platform version ("1C:Enterprise 8.3.xx.xxxx") and the configuration release — the line "Accounting for Kazakhstan, version 3.0 (3.0.74.2)". The instruction is relevant for the release indicated in italics at the beginning. 3. How to fill Most standard providers are already present in the directory as predefined items (provided by the standard subsystem library). You create an entry manually only if your CSP is not in the list or has a non-standard identifier. Click the "Create" button. Fields of the card: Field Purpose and what happens in case of error Name (mandatory) The displayed name, for example "CryptoPro CSP" or "Kalkan Crypt Provider (NUC RK)". It serves only for human selection. If left empty — the entry will not be saved. Program identifier in Windows The exact name of the cryptographic provider as registered in Windows (CSP Name), character for character. 1C accesses CryptoAPI by it. An error in one letter/space — 1C "will not find" the provider, the signature will not pass. Program type in Windows Numeric type of the provider (Provider Type), for example 75/80 for GOST, 1 for RSA. If it does not match the actual one — you will receive "Invalid algorithm" or "Key set does not exist" when signing. Program identifier in Linux The name of the provider in the Linux environment (relevant for server/web client on Linux). Filled in if you are working under Linux. Module name in Linux Path to the provider's dynamic library, for example /opt/cprocsp/lib/amd64/libcapi20.so. Incorrect path — "Failed to load module". Program identifier in macOS / Module name in macOS Similarly for macOS. Fill only for the corresponding OS. Signature algorithm OID/name of the digital signature algorithm (RSA, GOST 34.310, etc.). 1C matches the certificate and provider by it. If the algorithm is incorrect — the certificate will not "bind" to the program. Hashing algorithm OID of the hash algorithm (SHA-256, GOST 34.311/34.11, etc.). Encryption algorithm OID of the encryption algorithm — needed for encryption/decryption operations. Important principles for filling: - Identifier values are not invented — they are taken from the documentation of the cryptographic provider or from the result of auto-detection. The easiest way is to click on the settings form "Check program" / "Determine installed programs on the computer" — 1C will query the system itself and offer the correct entry. - One provider can serve several algorithms — then multiple OIDs are listed in the algorithm fields. - After creating an entry, it needs to be linked to the certificate: open the electronic signature key certificate → field "Program" → select your entry. 4. Analyzed example Situation. An accountant of an LLP in Kazakhstan received an RSA certificate from the NUC RK (egov.kz) (file RSA...pfx / token), installed NCALayer, and wants to sign the ESF directly from 1C through CryptoPro/Kalkan. At the first signing — an error "Certificate program not found". What to do step by step: - Administration → Electronic signature and encryption → the checkbox "Sign documents with electronic signature" is checked. - Tab "Programs" → "Determine installed programs on the computer". 1C queries Windows and finds the installed provider. - Check the found entry, for example: - Name: Kalkan Crypt Provider - Identifier in Windows: Kalkan Crypt Provider (type — RSA/GOST according to the certificate) - Signature / hashing algorithm — RSA + SHA-256 (for RSA certificate from NUC RK). - Open your certificate → field "Program" = created entry → "Check" → enter the container password → "Check completed successfully". - Return to ESF → "Sign and Send" → the document goes to the ESF information system. Entries for these numbers: there are none and cannot be. This is a directory of cryptography settings. It does not participate in accounting and tax accounting: neither income 6010, nor VAT 3130 (VAT rate in the RK from 2026 is 16%), nor cost 7010 it generates. The "magnet" of this object is not an entry, but a working signature: after correct configuration, the ESF for, say, a sale of 1,160,000 ₸ (including VAT 16% = 160,000 ₸) goes to the ESF information system on the first try. The actual entries Dr 1210 / Cr 6010 and Cr 3130 are created by the sales document, not this directory. 5. Types of operations The directory does not have separate "types of operations" like documents. Practically, there are modes of working with entries: - Auto-detection — 1C finds installed CSPs by itself and fills in the cards ("Determine installed programs"). - Using predefined — selecting a ready entry from the delivery (CryptoPro CSP, ViPNet CSP, Signal-COM CSP, LISSI-CSP, etc.). - Manual creation — for a non-standard/Kazakh provider (Kalkan, Tumar CSP), when auto-detection did not work. - Cross-platform configuration — filling in Windows/Linux/macOS blocks for working through the web client or on the server. 6. What is formed when using Since this is a directory, it has no entries. When working with it: - No accounting entries. - The directory does not create electronic documents (ESF/SNF). It only ensures the execution of the signature for documents that go to the ESF information system. - No movements in accounting registers. There are only service connections: the directory entry is used as a value in the "Program" attribute of the certificate directory and in the electronic signature settings. The result of correct configuration is seen indirectly: successfully signed and sent ESF, SNF, reports, reconciliation acts; correct certificate verification. 7. Print forms The directory element does not have separate regulated or accounting print forms — it is a technical card. Only the standard "Print list" / output list to a table document and Excel (button "More → Output list") is available. For diagnostics, the "Check program" button on the electronic signature settings form is more useful than printing. 8. Common errors - "No electronic signature and encryption program is installed on the computer." The provider is not installed in the OS or there is no entry in the directory. Install CryptoPro/Kalkan, then "Determine installed programs". - "Certificate program not found" / "Failed to determine program for the certificate". The "Program" field in the certificate card is empty or incorrect. Open the certificate → select the necessary directory entry → "Check". - "Key set does not exist" / "Invalid algorithm". The "Program type in Windows" or algorithm does not match. Check the provider type against the actual one (RSA vs GOST) and recreate the entry through auto-detection. - "Failed to load module …libcapi20.so". Incorrect path in "Module name in Linux" or the CSP package is not installed on the server. Check the path and installation. - "Certificate is invalid" / "Failed to build certificate chain". The problem is not in this directory, but in the root certificates of the NUC RK — install the chain through NCALayer/CryptoPro. - Duplicate entries after reinstalling CSP. Two identical programs appear. Keep the current one, reinstall the link in the certificates to it, mark the extra for deletion. 9. FAQ 1. Is it necessary to manually enter this directory? Usually no. Click "Determine installed programs on the computer" — 1C will fill in the card itself. Manual creation is only when auto-detection did not work. 2. How does this directory differ from the certificate directory? This stores the PROGRAM (cryptographic provider) and its identifiers/algorithms. Certificates are in a separate directory "Certificates of electronic signature and encryption keys", and each certificate refers to the program from here. 3. Which provider to choose for the RK? The one that is actually installed: CryptoPro CSP, Kalkan Crypt Provider, Tumar CSP — depending on the type of NUC RK certificate (RSA or GOST). Rely on auto-detection. 4. Does it affect amounts, VAT, or entries in ESF? No. The VAT rate (in the RK from 2026 — 16%), amounts, and entries (Dr 1210 / Cr 6010, Cr 3130) are generated by the sales document, not this directory. Here — only the signature technique. 5. I work through a web client/server on Linux — what to fill in? The blocks "Program identifier in Linux" and "Module name in Linux" (path to .so). The CSP must be installed on the server/agent for signing, and the extension for working with cryptography must be enabled. 6. Can I sign ESF without an entry in this directory? Through 1C — no: without a correct program, the signature will not be executed. An alternative is signing on the ESF information system portal or through NCALayer, but integration from 1C requires an entry here. 7. I deleted CSP, installed another — what to do? Determine the programs again, if necessary, create a new entry and reassign it in the "Program" field of the certificates. Mark the old entry for deletion after checking the links. 8. Why did new predefined programs appear after the release update? The list of CSPs is supplied by the standard subsystem library and is updated with releases. This is normal — use the necessary one, the rest do not interfere. 9. Where to get the correct "Program identifier in Windows"? From the provider's documentation or from the result of auto-detection. You cannot write the name "by ear" — 1C checks the string exactly. 10. Is marking an entry for deletion safe? Yes, if no active certificates refer to it. If there are links — first reassign the program in the certificates, otherwise the signature on them will stop working. 10. Related documents and objects - Certificates of electronic signature and encryption keys (directory) — each certificate refers to an entry from here through the "Program" field. The main "consumer" of the directory. - Electronic signature and encryption settings (form in the "Administration" section) — general switch for electronic signature and entry point to the list of programs. - Electronic documents, which are actually signed using this directory. ``` --- _BuhGPT — ИИ-помощник для бухгалтеров Казахстана: https://buhgpt.kz_