diff --git a/apps/api/src/services/sat/sat-auth.service.ts b/apps/api/src/services/sat/sat-auth.service.ts
index 02a7ced..b015bf7 100644
--- a/apps/api/src/services/sat/sat-auth.service.ts
+++ b/apps/api/src/services/sat/sat-auth.service.ts
@@ -27,7 +27,8 @@ function buildAuthRequest(credential: Credential): string {
   const uuid = randomUUID();
 
   const certificate = credential.certificate();
-  const cerB64 = Buffer.from(certificate.pem().replace(/-----.*-----/g, '').replace(/\n/g, '')).toString('base64');
+  // El PEM ya contiene el certificado en base64, solo quitamos headers y newlines
+  const cerB64 = certificate.pem().replace(/-----.*-----/g, '').replace(/\s/g, '');
 
   // Canonicalizar y firmar
   const toDigestXml = `<u:Timestamp xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" u:Id="_0">` +