ESF is not sent from 1C: NCALayer, digital signature, HTTP 400 — causes and solutions

Most often, ESF is not sent from 1C for one of six reasons. NCALayer is not running or is outdated. The database has the wrong or an expired digital signature key. The cryptography settings have gone wrong, which causes the “Http code 400” error with “VK code: 300”. The program has no access to the 1C:ESF service: a Basic version without service support, no ITS contract, or online support is not connected. The configuration release is behind the new ESF information system format. Or the ESF information system itself is temporarily down. It is easier to check in this order: first what the accountant can check alone, then what requires an administrator or a programmer. Below are a table of symptoms, a breakdown of each cause and the diagnostic order.

How an ESF gets from 1C to the ESF information system

In standard 1C configurations for Kazakhstan, direct exchange with the ESF information system works through the “1C:ESF for Kazakhstan” service. The chain looks like this:

1. The accountant creates a document in 1C.
2. The document is signed with a digital signature key via NCALayer with the “1C-Rating EDO” module or via the Kalkan library.
3. Signing and direct exchange work through the 1C:ESF service: the program gets the cryptographic library through it. The service is available only if online support is connected and a 1C:ITS contract is valid.
4. The signed document goes to the ESF information system, and its status returns to the database.

If even one link breaks, the document is not sent. So the first rule is to read the full error text and save a screenshot of it. It almost always shows which link failed.

ESF sending error: a table of symptoms

What you see	Likely cause	What to do
1C or the browser cannot connect to NCALayer (“Error connecting to the layer”)	NCALayer is not running, outdated or damaged	Start NCALayer. If that does not help, uninstall it, restart the computer and install the latest version from ncl.pki.gov.kz
“External component error”	NCALayer lacks the “1C-Rating EDO” module, or the cryptography component fails	Check the module, then click “Check operation” in the 1C cryptographic library settings
CERTIFICATE_EXPIRED when logging in to the ESF information system	After the key was reissued, the old certificate remained in the database	Load the new key file into the ESF information system user record
Http code 400 … VK code: 300	Cryptographic library settings, or no access to the 1C signing service	Steps 3 and 4 below
“Could not connect to the online support portal for the following reason: Invalid login and password”	Online support is not connected, or it has the wrong login and password for the 1C:ITS portal	Reconnect online support, check the ITS contract
Invalid content was found starting with element 'transportTypeCode'	The 1C release does not know the new ESF format (ESF information system update of 10.07.2026), or the “Payment method” field is empty	Install the 1C update, fill in the “Payment method” field
“Insufficient rights to access data”	The employee has no authority in the ESF information system, or the profile type is wrong	The head of the company grants authority on the ESF information system portal
Responses with code 5xx, timeouts, the ESF information system portal does not open either	Maintenance or an ESF information system failure	Check KGD notices and follow them

Step 1. NCALayer is not running, outdated or missing the required module

NCALayer is a program of the National Certification Authority (NUC RK) through which web portals and 1C work with digital signature keys. NUC states directly that it must be started before each session on a website or portal that uses a digital signature. What to check:

• Whether NCALayer is running. Its icon should be in the Windows notification area. If there is no icon, start the program and repeat the sending.
• Whether the version is current. NUC RK recommends using only new versions of NCALayer and, in case of digital signature problems, updating the program first. Download it only from the official website ncl.pki.gov.kz.
• Whether the “1C-Rating EDO” module is installed. Documents from 1C are signed using this module. Right-click the NCALayer icon, open “Module management” and make sure the module is installed. If it is not, install it.

After an NCALayer update, the module stopped working

In autumn 2024, the NUC forum discussed such a case. The NCALayer installer included a new Java version that stopped supporting some outdated algorithms. The ESF information system module for NCALayer was signed with one of them, and after the update it could no longer be installed. For NCALayer connection errors, the NUC forum moderator gives a general recipe: uninstall the old version, restart the computer, install the new one and check that the NUC root certificates are installed.

NUC root certificates

If NCALayer works but the key is not accepted as trusted, check the root certificates. The pki.gov.kz/cert/ page publishes the root certificates of KUC, the root certification authority (RSA 2020 and GOST 2022), and of NUC (RSA 2022 and GOST 2022); all are valid until 2045. Get them only there.

Operating system and 1C client limitations

According to PRO1C portal specialists, the 1C cryptography library for ESF is supplied only for Windows and Linux; this signing method does not work on macOS. In addition, the signing setup described here is designed for the 1C thin client: if the accountant works in the web client through a browser, the component may be unavailable.

Step 2. Wrong or expired digital signature key

Previously, NUC issued a pair of keys: AUTH for logging in to information systems and RSA or GOST for signing. A typical mistake is to sign a document with the AUTH key or log in with the signing key.

On 26 November 2022, NUC began issuing keys based on the GOST R 34.10-2015 algorithm, at first only to individuals through the personal account. This is one key for both signing and authentication. Since April 2025, according to PRO1C, legal entities and individuals receive only this type of key, a file with a name like GOST512…p12. For 1C, this has two consequences:

• Since 26 November 2023, the previous login method for the ESF information system has not been available for GOST 2015 keys. The new authentication mechanism is supported in 1C:Accounting 8 for Kazakhstan ed. 3.0 starting from release 3.0.50.1, and in ed. 2.0 from release 2.0.37.1. An old release and a new key do not work together.
• Cryptography component version 1.8 does not support keys of the new format.

The key was reissued, and ESF stopped going out

The error “An error occurred when logging in to the ESF information system: The certificate has expired CERTIFICATE_EXPIRED” means that the old certificate remains in the database. In 1C:Accounting 8 for Kazakhstan ed. 3.0, open “Administration” — “General settings” — “Electronic invoices”, the “ESF information system users” tab. The “Certificate for logging in to the ESF information system” field shows the date until which it is valid. Select the new key file with the “Select certificate” button, then save the setting with the “Save and close” button. Repeat this for each user who sends ESF.

It is better to track the key expiry date in advance. A key can be reissued online in the NUC personal account only if you have a valid key. If it has already expired, the key will have to be issued again from scratch, and ESF will be stuck all that time.

An employee signs but has no rights

If ESF is sent not by the head of the company but by an accountant with their own key, the accountant must have authority to issue ESF in the ESF information system. The head of the company grants it on the ESF information system portal: the “Registration” — “Personnel management” section. Without authority, the system will reply “Insufficient rights to access data”. In 1C, also check the ESF information system user record: if an employee sends, the profile type must be “Employee”.

A legal entity is registered in the ESF information system using the certificates of the first head. So when the director changes, new keys in 1C are not enough: first the new head gets digital signature keys and the organization is re-registered on the ESF information system portal, and only then are the certificates changed in 1C.

Step 3. HTTP 400 error and “VK code: 300”

Under the HTTP standard (RFC 9110), code 400 means that the server cannot or will not process the request because of a client error. The client here is your 1C. So the cause should be looked for in what the database sends and how: the signature, the session or the document format.

A typical text looks like this: Http code 400. Error accessing 1C signing services. Contact the service technical support. VK code: 300. External component error. According to accounting portal publications, such errors became more frequent in 2024, after changes to the ESF information system crypto library and the move to a single digital signature key. What to check, in order:

1. The “1C-Rating EDO” module in NCALayer — see step 1.
2. Cryptography provider. In “Administration” — “General settings”, there are “Cryptographic library” settings (in Accounting, it is a tab in the electronic invoice settings; the exact location depends on the release). There you choose NCALayer or Kalkan. If NCALayer is selected, the Kalkan external cryptography option must be turned off. Kalkan is needed only when NCALayer cannot be used for technical reasons: it requires the NUC developer kit and installing the library in system folders.
3. Signing checkboxes. If your release has them, “Use session opening with signature” and “Use NUC RK cryptography for signing documents” must be selected. In recent Accounting releases, the new session opening mechanism always works, and there may be no separate checkbox.
4. The “Check operation” button. It shows whether 1C sees the component and the key. If the check fails, there is no point in sending documents further: this link has to be fixed first.
5. Where cryptographic operations run — on the 1C server or on users' computers. If the error repeats on the server, publications for accountants advise temporarily clearing the Kalkan external cryptography checkbox and moving the operations to users' computers. In a client-server database, it is better to change such settings together with the administrator.

If everything is set up but “VK code: 300” remains, look at the error text itself: it refers you to the service technical support. So the problem may be in access to the 1C:ESF service; go to step 4.

Step 4. No access to the 1C:ESF service: Basic version, ITS, online support

Since 2023, direct exchange between 1C and the ESF information system has gone through the “1C:ESF for Kazakhstan” service. It can be connected by registered users of the PROF and CORP versions with a 1C:ITS Kazakhstan contract, users of the 1cfresh.kz cloud and, starting with release 3.0.53.2 (December 2023), users of 1C:Accounting Basic with a 1C:ITS contract at the TECHNO or PROF level. When the service was launched, 1C announced limits: a PROF-level ITS contract allows connecting up to 10 organizations, a TECHNO-level one allows one.

Hence three common reasons why ESF is “not sent”:

• The Basic version. 1C:Accounting Basic has direct exchange starting with release 3.0.53.2 with a 1C:ITS contract at the TECHNO or PROF level; in an older release or a Basic program without service support, documents are exported to XML and uploaded to the portal. How the versions differ and when to move is covered in the article on choosing between Basic and PROF.
• The ITS contract has ended. Without it, the service stops working, even if everything was sent before. The types of contracts are described in the article on 1C:ITS plans.
• Online support is not connected. It is turned on in “Administration” — “Online support and services”. The program with an ITS contract (and the additional 1C:ESF service package, if it was bought for extra organizations) must be registered in the same ITS portal account through which online support is connected. If support is not connected or it has the wrong login and password, sending will show the error “Could not connect to the online support portal for the following reason: Invalid login and password”.

Step 5. Outdated configuration release

The ESF information system changes the document format following legislation, and 1C releases updates for this. A recent example: on 10 July 2026, the ESF information system updated the ESF form and XML format to meet the requirements in force since 1 January 2026. In section E, the optional “Payment terms” field was replaced with the mandatory “Payment method” field with the values “Cash” or “Non-cash”.

If 1C is not updated or the new field is not filled in, the ESF information system rejects the invoice with the error Invalid content was found starting with element 'transportTypeCode'. One of '{paymentForm}' is expected. If the old field remained filled in, the system replied “Must be empty”. 1C released patches dated 10.07.2026: for 1C:Accounting 8 for Kazakhstan, for releases 3.0.72.1 and 3.0.73.1; for ERP and Integrated Automation, for 2.4.5.20 and 2.4.5.21; for Trade Management, for 3.4.5.21.

There are older thresholds too. The 1C:ESF service is built into 1C:Accounting 8 for Kazakhstan ed. 3.0 starting from release 3.0.49.1, into Trade Management from 3.4.4.110, and into ERP and Integrated Automation from 2.4.4.110. Databases older than these releases have no direct exchange at all.

The conclusion is simple: keep the release up to date, especially in years of tax reforms. If the configuration is customized, it cannot be updated with one click: the changes need to be compared and merged. This is a separate job — 1C update by a programmer.

Step 6. A problem on the ESF information system side

Sometimes 1C has nothing to do with it. Open the ESF information system portal (esf.gov.kz:8443) and try to log in manually. If the portal does not open or KGD has announced maintenance, wait until it ends. In 2026, such maintenance took place, for example, on 5 and 20 February, 25 April and 10 July. Under the HTTP standard, 5xx codes mean a server-side error, and 503 means a temporary overload or scheduled maintenance.

KGD specifies what to do with documents in its notices about system outages. For example, after the maintenance on 25 April 2026, a paper invoice had to be entered into the ESF information system within 15 calendar days, and an accompanying waybill within 3 business days from the specified dates, and no fines were applied. The deadlines differ each time, so check the specific notice.

If the portal works and only your 1C fails to send, you can issue an urgent document manually on the portal and fix the exchange in parallel. Afterwards, do not send the same document from 1C a second time.

For questions about the ESF information system itself, the unified contact center 1414 works free of charge around the clock. You can write to esfsd@kgd.minfin.gov.kz. Do not change the subject of the reply email: it contains service data for tracking the request.

Diagnostic order: from simple to complex

1. Save the full error text and the time it appeared.
2. Open the ESF information system portal: check whether it works and whether maintenance has been announced.
3. Check that NCALayer is running and updated, and that the “1C-Rating EDO” module is installed.
4. Check the validity of the digital signature key and that the right file is selected in 1C. New key — GOST512…p12.
5. Check the certificate in the ESF information system user record in 1C and the profile type.
6. If an employee sends, check their authority on the ESF information system portal.
7. Click “Check operation” in the “Cryptographic library” settings.
8. Check the program version (PROF or CORP), the ITS contract and the online support connection.
9. Check that the configuration release has the latest fixes for the ESF information system format.

If ESF stopped going out for all users at once on the same day, start with points 2, 8 and 9. If only for one accountant, start with points 3–6.

When to call a specialist

The accountant can go through points 1–7 alone. A specialist is needed if:

• the database is client-server, cryptography runs on the 1C server and administrator rights are needed;
• the configuration is customized, and a release update requires merging changes;
• there are several organizations, and exchange runs from different databases or under different ITS contracts;
• after all the steps, the error repeats or has changed to a new one;
• you need to move from the Basic version to PROF without losing data;
• ESF breaks after every ESF information system update, and this gets in the way of work.

AC PRO has worked with 1C in Almaty since 2018 and connects remotely across Kazakhstan. We set up exchange between 1C and the ESF information system and sort out errors in sending ESF, EAVR and SNT. How to set up SNT and the virtual warehouse is described in detail in the instructions on SNT and the virtual warehouse in 1C. If the exchange regularly breaks after updates, it is easier to hand the database over for 1C support: releases and exchange settings will be updated on time.

Summary: a short checklist

• NCALayer is running and updated, and the “1C-Rating EDO” module is in place.
• The digital signature key is valid, this exact key is loaded into 1C, and the release supports GOST 2015 keys.
• Signing checkboxes are selected, and “Check operation” passes without errors.
• The version is PROF or CORP, the ITS contract is valid, and online support is connected.
• The configuration release includes the latest fixes for the ESF information system format.
• The ESF information system portal itself was checked before a long search for the cause.

If ESF is still not sent after these checks, send us the error text, and we will tell you which link failed and how long the fix will take.