Incorrectly Signed MDN

When an MDN fails signature validation, Files.com cannot verify the receipt using the configured trading partner certificate. Check the AS2 Logs for the specific processing error. A general MDN processing failure can also have other causes, such as an invalid disposition or Message Integrity Check (MIC).

Confirm with your trading partner that they signed the receipt using the private key matching the public certificate in your trading partner configuration. A renewed or replaced certificate must be exchanged and updated on both sides.

The MDN validation level determines which checks must pass. Lowering it can accept receipts that lack the signature or certificate checks your workflow requires. Correct a certificate mismatch before considering a different validation level.

You can inspect a certificate embedded in the MDN signature with OpenSSL and give its details to the partner. Inspection identifies the certificate; it does not itself verify the MDN's signature or delivery outcome.

PEM Base64 Encoded Signature

For a signature part with Content-Transfer-Encoding: base64, save only its base64 body to signature.b64. Exclude MIME headers and boundary lines. Decode it, then inspect the certificates in the resulting PKCS#7 data:

openssl base64 -d -in signature.b64 -out signature.der
openssl pkcs7 -inform DER -in signature.der -print_certs -text -noout

If the signature was exported as PEM with -----BEGIN PKCS7----- markers, use openssl pkcs7 -inform PEM -in signature.pem -print_certs -text -noout instead.

Binary Signature

For a signature part with binary transfer encoding, save its body unchanged to signature.der using a tool that preserves binary data. Exclude MIME headers and boundaries, then inspect it:

openssl pkcs7 -inform DER -in signature.der -print_certs -text -noout

Certificate Purpose

A certificate can include restrictions on its intended use. Strict MDN validation requires a valid certificate chain and an S/MIME signing purpose; Normal permits self-signed certificates and certificates without that purpose while still requiring a valid signature, MIC, and disposition.

To inspect the purposes of your partner's PEM certificate:

openssl x509 -in partner.pem -noout -purpose