Certificates and Encryption
AS2 uses two X.509 Certificates.
One certificate protects the connection to your AS2 HTTPS endpoint. The other supports message encryption and digital signatures on messages and receipts exchanged with your trading partner.
The same certificate can serve both purposes, but this isn't recommended. Partner certificates tend to be longer lived, while HTTPS endpoint certificates are renewed more frequently.
Message Encryption and Signing
Message level encryption is implemented using S/MIME. S/MIME (Secure/Multipurpose Internet Mail Extensions) is a standard for public-key encryption and signing of MIME data.
Files.com signs outgoing messages using your AS2 identity's private key and encrypts them using your trading partner's public AS2 certificate. Your partner uses their private key to decrypt the message and your public certificate to validate its signature.
Incoming messages can be signed or unsigned, with or without S/MIME message encryption. This allows Files.com to receive the message format agreed with your partner. The partner's incoming signature validation level determines whether a valid signature is required; it does not require message encryption. Normal requires a valid signature even when the message is encrypted, while None permits unsigned messages.
When message encryption is used, the payload remains encrypted independently of the connection carrying it. Without S/MIME message encryption, the HTTPS connection still protects the transmission, but the message itself has no separate S/MIME encryption.
AS2 HTTPS Endpoint Certificate
Files.com receives incoming AS2 transmissions over HTTPS on port 443. An X.509 SSL certificate protects that connection using TLS, formerly known as SSL. The AS2 endpoint uses the same certificate and TLS/SSL ciphers as your site's web portal and Custom Domain. All trading partners connecting to that endpoint use this protection, independently of whether their AS2 messages are signed or encrypted.
By default, Files.com generates, manages, and rotates the certificate automatically, renewing it before expiration. If you supply your own SSL certificate, it also applies to your AS2 endpoint, and you are responsible for its renewal. The AS2 page shows the expiration date of the certificate in use.
Outgoing connections use the trading partner's HTTPS certificate. When configuring the trading partner, choose whether to require a valid, chained, trusted, matching certificate or accept a less secure certificate, such as a self-signed one.
HTTPS endpoint certificates are renewed more frequently than partner certificates. SSL certificates were once commonly valid for 2 or 3 years, but much shorter durations are now standard.
AS2 Partner Certificate
AS2 partner certificates support message encryption and signature validation independently. Files.com signs and encrypts outgoing messages. Incoming messages can use either, both, or neither, subject to the partner's signature validation level. The separate HTTPS certificate protects the connection regardless of those message settings.
Each trading partner requires two X.509 format certificates to encrypt and sign AS2 messages. One certificate is their own and the other certificate is their trading partner's.
Certificates have a public portion and a private key. Each trading partner exchanges the public portion of their certificate with each other.
Files.com also uses your AS2 identity's private key to sign MDN receipts. Your partner verifies those receipts with your public certificate, including receipts for incoming messages that were unsigned.
The expiration date of your AS2 partner certificate is shown next to your AS2 Identity on the AS2 page. Each of your AS2 Identities may have its own certificate or a certificate may be shared with multiple AS2 Identities.
The expiration date of your trading partner's AS2 partner certificate is shown next to their entry in the AS2 Trading Partners table on the AS2 page. Use this date to plan renewal with your partner. Normal incoming signature validation, including when Auto selects Normal, checks the signature and signed content without checking the certificate's validity dates. An expired or not yet valid certificate can still validate incoming signatures while it remains configured; its expiration date does not end acceptance of its signing key.
Our site alert email feature does not trigger for expiring partner AS2 certificates and does not include information about them. Review the AS2 Trading Partners table periodically to plan upcoming certificate changes.
Partner certificates tend to be long lived due to the impact of transmission interruptions when updating them. It's common to have partner certificates that are valid for 5 years or longer. Ultimately the duration of partner certificates is agreed upon between you and your trading partner.
Generating Your Encryption and Signing Certificates
The Generate in browser certificate source generates self-signed certificates and keys for you when creating an AS2 identity or replacing its certificate.
Your IT department or your SSL Certificate provider can provide fully valid and chained Certificates and Keys. You, or your IT department, can also generate your own self-signed Certificates and Keys.
To generate self-signed Certificates and Keys yourself, use the openssl command:
openssl req -x509 -days 365 -newkey rsa:2048 -keyout key.pem -out certificate.pem -nodes
Your trading partners view this Certificate to identify you and your business details, so it must contain accurate information.
When prompted by openssl, enter the following information:
| Item | Description |
|---|---|
| Country Name | Enter the 2 letter code for the country. For example, "US". |
| State or Province Name | Enter the full name of the State or Province. For example, "California". |
| Locality Name | Enter the full name of the city, town, village, or locality. For example, "San Francisco". |
| Organization Name | Enter the full name of your business or company. For example, "Files.com". |
| Organizational Unit Name | Enter the full name of your department, division, or team. For example, "Partner Relations". |
| Common Name | Enter the fully qualified domain name (FQDN) of your AS2 URL, or the fully qualified domain name of your business, that this certificate represents. For example, "mysite.files.com" or "mydept.mycompany.com". |
| Email Address | Enter a valid email address for your trading partners to use to contact you in case of any problems or questions about this certificate. |
Converting Certificate Types
Files.com AS2 supports separate PEM or CRT certificates and keys, and PKCS#12 (.pfx or .p12) packages. If your certificate provider or AS2 system supplies a PFX or P12 file, you can import it directly without converting it to PEM.
The PKCS#12 password opens the package during import. Files.com does not retain the file or its import password.
You can use openssl to create and convert certificates and keys.
There are also various online guides and tutorials available describing how to convert certificates from one type to another.
Downloading Public Certificates
When generating your certificates, you have the option to download and save them.
Private certificates must be protected and never shared. Public certificates can be freely shared.
You can re-download the public certificates of your AS2 Identities, and the public certificates of your AS2 trading partners, from your site's AS2 configuration settings.
Renewal and Replacement
AS2 Partner Certificates are the certificates exchanged between you and your trading partners for message encryption and digital signing. Plan certificate renewal with each partner so both systems use matching certificates and keys when the change takes effect.
Files.com manages renewal of the default HTTPS endpoint certificate that secures your AS2 URL. If you supply your own TLS/SSL certificate for a custom domain, you are responsible for replacing it before it expires.
Coordinate changes to corresponding certificates and keys on both sides of the partnership to minimize communication outages.
For example, when you replace your certificate and private key, your trading partner applies your new public certificate at the same time. When your trading partner replaces their certificate and private key, you apply their updated public certificate at the agreed time.
You do not need to update your own certificates when a trading partner's certificate expires, and vice versa. You only need to update and exchange the corresponding portions of the expiring certificate.
Coordinate with your trading partner before a certificate's expiration and agree on a change window for applying the updated certificates.
When a test or dev site is available to you, test and verify any certificate changes on the AS2 configuration of that site before applying them to your production site. You can also use a test or dev AS2 partnership connection, where you and your trading partner have agreed upon test or dev AS2 Identities for testing purposes.
Updating Your AS2 Identity Certificate
When replacing the certificate associated with your AS2 Identity, exchange the public portion of your new certificate with every trading partner connected to that AS2 Identity. Confirm each partner's renewal requirements and schedule before making the change, since their systems determine whether to accept your certificate and signatures.
On your AS2 identity's details page, edit the Public Certificate row and choose a Certificate Source. You can generate a new certificate, import a PKCS#12 (.pfx or .p12) file containing your certificate and matching private key, or upload or paste the certificate and key separately. The identity configuration requirements apply to replacements too.
Export the public portion of the new certificate and send it to all trading partners that are associated with this AS2 Identity. As this portion is public, it can be sent or shared via email or secure Share Link.
Updating a Trading Partner's AS2 Certificate
The expiration date shown in the AS2 Trading Partners table helps you plan renewal with your partner. At the Normal incoming signature validation level, including when Auto selects Normal, Files.com verifies signatures against the configured partner certificate without checking its chain, signing purpose, or validity dates. A certificate that is expired or not yet valid can still validate incoming signatures as long as it remains configured. This prevents a certificate date from interrupting business exchanges while both teams coordinate a replacement.
Normal still requires a valid signature from the configured partner certificate and unchanged signed content. It rejects unsigned messages and messages signed with a different key. Certificate expiration does not end acceptance of the configured signing key.
To stop accepting incoming messages from a partner, delete their trading partner configuration. To continue the partnership with a different signing key, replace the configured public certificate with one for the new key and keep incoming signature validation set to Normal. Coordinate the replacement with your partner because Files.com also uses this certificate to encrypt outgoing messages to them.
For a planned renewal, edit the Public Certificate row on the partner's details page during the agreed change window. Choose Import PKCS#12 File (PFX or P12) or Upload or Paste Public Certificate to import their new certificate. The trading partner configuration requirements apply to replacements too.
Contact your trading partner and ask them to provide their updated public certificate in PEM or CRT format, or in a PKCS#12 (.pfx or .p12) package containing only their public certificate. A PEM or CRT format certificate begins with -----BEGIN CERTIFICATE----- and ends with -----END CERTIFICATE-----. As this portion is public, it can be sent or shared via email or secure Share Link.