Certificates and keys

What you exchange with a partner

AS2 trust is pairwise and pinned: you give the partner your certificate, they give you theirs, and each side installs the other’s. There is no CA hierarchy involved in partner identity (self-signed certificates are the norm in AS2).

Your certificate/key is used to sign outgoing messages and decrypt incoming ones; the partner’s certificate verifies their signatures and encrypts messages to them.

The keystore

Keys are looked up by alias — the names you chose in each partnership’s cert_aliases:

cert_aliases = { local = "me", remote = "acme" }

PEM directory (default)

keys_dir holds PEM files named by alias:

keys/
├── me.key.pem     # our private key (PKCS#8)
├── me.cer.pem     # our certificate
└── acme.cer.pem   # partner certificate (no key)

Generate a self-signed identity:

openssl req -x509 -newkey rsa:3072 -sha256 -days 1095 -nodes \
  -keyout me.key.pem -out me.cer.pem -subj "/CN=MYCOMPANY AS2"

Convert a partner’s .p7b/.cer/.pfx to PEM with the usual openssl pkcs7 -print_certs / openssl x509 -inform der / openssl pkcs12 -legacy commands.

Azure Key Vault (optional)

With [storage.key_vault] configured, aliases resolve to Key Vault secrets holding the PEM content ({alias}-key and {alias}-cert, alias sanitized to Key Vault’s [A-Za-z0-9-] name alphabet), and authentication uses the platform’s managed identity — no key material on disk, no credentials in config. Entries are cached with a TTL, so a rotated secret takes effect without restart.

Validity and rotation

• Certificate validity windows are enforced: as2d will not sign with an expired or not-yet-valid certificate, and pinned-cert verification checks the window too.
• Every certificate within 30 days of expiry is called out at startup, and expired ones are flagged as errors — certificate expiry is the single most common cause of AS2 outages, so as2d makes it loud and predictable.
• To rotate: install your new certificate alongside the old (a second partnership/alias during the overlap window is the cleanest pattern), send the new public certificate to partners, then retire the old alias.