Replacing an expired AS2 certificate

Logicbroker does not let you remove an AS2 certificate while any of your EDI connections still uses it. To replace an expired or expiring certificate, add the new one first, switch your connections to it, and then remove the old one.

Before you start

• You need the new public certificate as a .cer or .crt file. Private certificates are rejected.
• You need permission to manage settings in the Logicbroker portal.

Steps

1. In the Logicbroker portal, go to Connections > EDI.
2. In My AS2 Certificates, click Add a new AS2 certificate and drop in or choose your .cer or .crt file. The new certificate appears in the table with its Thumbprint and Expiration Date. Note its thumbprint.
3. In My EDI Connection, click Edit on your connection. In the AS2 Certificate dropdown, select the new certificate (certificates are listed by thumbprint), then click Save. Repeat this for every connection override that uses AS2.
4. Switch your own AS2 software to the new certificate's private key at the same time, so messages keep flowing.
5. Back in My AS2 Certificates, click Remove next to the old certificate and confirm.

Which certificate to upload

This applies to suppliers and retailers who connect to Logicbroker by AS2, and to the EDI provider that runs AS2 for them.

Your certificate provider or partner may send several files: a root CA certificate, one or more intermediate CA certificates and the AS2 certificate itself. Logicbroker reads one certificate from each file you upload, and uses it to encrypt the messages it sends to your AS2 ID.

1. Pick the certificate that your AS2 software uses for this connection. It is usually the lowest certificate in the chain, issued to your company, and is sometimes called the leaf or end-entity certificate.
2. Export it as a public .cer or .crt file, without the private key.
3. In Add an AS2 Certificate, drop in the file. Before you click Save, check that the Thumbprint and Expiration shown match the certificate in your AS2 software.

If the thumbprint does not match, you picked a CA certificate or an old file. Choose another file. If you are not sure which file is right, ask the team that issued the certificate.

Stage and Production are separate

The Stage portal and the Production portal each have their own AS2 certificates and EDI connection. In the Stage portal, the EDI page shows this message: These settings will only be applied to your stage environment. You will need to configure a separate EDI connection in production.

• If your new certificate is for testing only, change it in the Stage portal only.
• If it is for live orders, change it in the Production portal.
• If the same certificate is used for both, repeat the steps in each portal.

After the change, open your connection in My EDI Connection, click Test Connection, then Continue. The test worked when you see Connection Successful!. If you see Connection Failed!, click View Full Report to see the details.

Your partner asks for a certificate change at a set time

A retailer or EDI provider sometimes sends a new certificate with a cutover date. You can upload it yourself before that date (step 2), then select it on your connection (step 3) at the agreed time.

If you want Logicbroker Support to make the change for you, send the request ahead of time. Support makes these changes during working hours, Eastern Time, and will agree a time with you. Changes late in the day or at weekends may not be possible, and failed documents may not be reviewed until the next business day.

Include in your request:

• the new public certificate as a .cer or .crt file, not a ZIP file;
• whether it is for Stage, Production or both;
• the date and time it must take effect;
• whether the AS2 ID or AS2 URL is also changing, or only the certificate.

Your partner requires AES encryption or SHA-256 signing

Some retailers and marketplaces now require stronger AS2 algorithms, such as AES256 encryption and SHA-256 signing. A partner may return an MDN with the error insufficient-message-security, or report that it is unable to decrypt the message. These errors can mean the algorithms do not match, but they often mean a certificate is wrong or expired. Check the certificates on both sides first.

Each AS2 connection has its own encryption and signing settings for the messages Logicbroker sends to that connection.

1. Go to Connections > EDI.
2. In My EDI Connection, click Edit on the AS2 connection.
3. Click Show advanced options.
4. In AS2 Encryption, choose AES128, AES192 or AES256. In AS2 Signature, choose SHA-256 or SHA-512. Use the values your partner asked for.
5. Click Test Connection, then Continue, and check for Connection Successful!.
6. Click Save.

Make the change in Stage first and test it there before you change Production. If the test fails because the partner's certificate has expired, get the partner's current certificate and replace it with the steps above first. If the connection is managed for you and you cannot edit it, ask Logicbroker Support to change it and tell them the exact algorithms your partner requires.

Getting Logicbroker's own AS2 certificate

Your AS2 software also needs Logicbroker's public certificate. To get the current one, go to Connections > EDI, click Edit on your AS2 connection and, under Logicbroker connection details, click Download next to Certificate. Logicbroker's AS2 IDs, URLs and IP address are listed in AS2 Information (EDI Only).

If your retailer or EDI provider asks whether Logicbroker's certificate is changing, contact Logicbroker Support before you change anything on your side.

Messages you might see

• You cannot remove that certificate since it is currently in use on one of your connections. At least one connection or connection override still has the old certificate selected. Repeat step 3 for it, then try again.
• You must upload a public certificate not a private certificate. Export the public certificate (.cer or .crt) and upload that instead.
• That certificate already exists. The certificate is already in your My AS2 Certificates table, so go straight to step 3. If you expected a new certificate, compare its thumbprint with the one in the table. The file you have may be the old certificate.
• A certificate with the same name already exists. Contact Logicbroker Support.
• Certificate invalid: followed by details. Logicbroker could not read the file. Export the certificate again as a .cer or .crt file and retry.
• Unable to load certificate for AS2 receiver identifier followed by an AS2 ID. The connection for that AS2 ID has no usable certificate. Upload the certificate and select it in AS2 Certificate on that connection.
• A negative MDN after you switch certificates. Check that the connection has the new certificate selected (step 3) and that your AS2 software uses the matching private key (step 4).

When to contact Support

Contact Logicbroker Support if the connection test still fails after these checks. Include:

• your company ID (CoId) and company name;
• the retailer or partner the connection is for;
• Stage or Production;
• the thumbprint and expiration date of the certificate you want to use;
• the exact error, or a screenshot, and the MDN if you have one;
• what you already tried.

Related: How to set up my EDI connection

Related: AS2 Information (EDI Only)