If you're handling EDI for your business — whether you're an IT director, the go-to EDI coordinator, or a risk-averse CFO — you already know how much can go off the rails when something as simple as a certificate expires. This guide walks through exactly how to take charge of AS2 certificates in under 15 minutes, manage setup and rotation confidently, and prevent the downtime that makes even EDI veterans sweat.
⚡ Quick Answer
AS2 certificate setup takes under 15 minutes: generate a self-signed X.509 certificate with OpenSSL, upload your private key and public cert to your EDI portal, add each trading partner's public certificate, and enable signing and encryption. For rotation with zero downtime, run old and new certificates in parallel for at least 48 hours before making the new one primary.
Executive Summary
- AS2 certificates provide authentication, encryption, and non-repudiation — the three pillars of secure B2B EDI document exchange.
- Self-signed X.509 certificates are acceptable for most trading partners; CA-issued certificates are only required for strict regulatory environments.
- Zero-downtime certificate rotation is achievable by running old and new certificates in parallel — both accepted simultaneously for at least 48 hours during the switchover.
- The most common pitfalls are mismatched key usage attributes, slow partner turnarounds during rotation, and inadequate audit history for compliance reviews.
- Calendar reminders at 30 and 7 days before expiry, a centralised certificate portal, and a 7-year archive are the operational essentials for stress-free certificate management.
Why Are AS2 Certificates Non-Negotiable for Secure EDI?
AS2 certificates keep your B2B transactions — invoices, shipment notices, purchase orders — locked down in transit, authenticating both sender and receiver while encrypting your most sensitive supply chain data. Every modern compliance framework expects you to get this right, especially if you're exchanging X12 or EDIFACT EDI documents with global partners.
| Function |
What It Does |
Why It Matters |
| Authentication |
Verifies the identity of the sender and receiver |
Ensures only authorised parties can exchange documents |
| Encryption |
Makes data unreadable to anyone intercepting transit |
Protects proprietary pricing, inventory, and order data |
| Non-Repudiation |
Cryptographically signs every message with a timestamp |
Creates irrefutable proof of who sent what and when |
How Do You Set Up and Rotate AS2 Certificates Without Downtime?
1
Generate Your AS2 Certificate
You don't need to be a cryptography expert. For most trading partners, self-signed X.509 certificates are perfectly acceptable. CA-issued certificates are only required where strict regulatory compliance mandates it.
Generate a self-signed certificate with OpenSSL:
openssl req -newkey rsa:2048 -nodes -keyout yourcompany.key -x509 -days 365 -out yourcompany.cer
- →Your private key (
yourcompany.key) — keep this secret, never share it
- →Your public certificate (
yourcompany.cer) — share this with your trading partners
- →Export the public cert in BASE64 format if partners require it
2
Plug Your Certificate Into Your EDI Workflow
Once the certificate is generated, wire it up so documents start flowing securely:
- →Log in to your EDI portal and navigate to AS2 settings
- →Upload your private key and public certificate to your profile
- →Add each trading partner's public certificate — their side only, not the full key history
- →Assign your unique AS2 ID and each partner's AS2 ID
- →Enable signing and encryption
- →Send a test document (such as an 850 purchase order) to verify the connection
3
Rotate Certificates With Zero Downtime
When a certificate expires on a weekend, EDI traffic halts and the scramble begins. Here's how to avoid it entirely:
- →Generate your new certificate pair (repeat Step 1) and label it clearly
- →Distribute the new public certificate to partners — allow at least a 2-day window
- →Upload the new certificate as secondary in your portal — keep the old one as primary
- →Confirm all partners have acknowledged and accepted the new certificate
- →Promote the new certificate to primary with a single click
- →Keep the old certificate on standby for at least 48 hours — both accepted simultaneously during the transition
- →Archive the old certificate — retained for up to 7 years for audit trails
During this parallel-certificate process, your EDI keeps moving. No mailbox fee spikes, no lost invoices, no partner-facing service interruptions — because that's what your CFO actually cares about at the end of the quarter.
What Are the Most Common AS2 Certificate Pitfalls and How Do You Avoid Them?
Common Pitfalls
- •Mismatched key usage — always verify certificate attributes for signing and encryption before deployment; automated validation catches this before it causes a failed transmission
- •Slow partner turnarounds — some trading partners have sluggish IT teams; have your EDI provider handle the outreach and technical configuration so you're not stuck waiting on a critical certificate swap
- •Inadequate audit history — if an auditor asks for EDI event details after the fact, you need a full log; ensure 90 days of instant portal access and 7-year archival as standard
- •Missed expiry dates — an expired certificate on a Friday afternoon stops all EDI traffic; set calendar reminders at 30 days and 7 days before any expiry
Best Practices for EDI Veterans
| Practice |
Why It Matters |
| Calendar reminders at 30 and 7 days before expiry |
Eliminates the risk of auto-lockouts and weekend scrambles |
| Centralise all partner certificates in one portal |
Replaces scattered spreadsheets and email chains with a single source of truth |
| Practice rotation with a non-critical partner annually |
Keeps your team confident and the process familiar before it matters |
| Maintain a 7-year certificate archive |
Satisfies compliance, regulatory, and partner audit requirements on demand |
Scaling Securely as Your Partner Network Grows
Whether you're onboarding a new retailer or expanding logistics with a new 3PL, each change brings new AS2 requirements. A well-managed EDI platform handles this without disruption:
- •Free onboarding for all new trading partners — no per-partner setup fees
- •No forced changes to your current EDI documents or protocols during expansion
- •Transitions are invisible to trading partners — no need to coordinate downtime or send partner notifications
- •Direct ERP integration with NetSuite, SAP, Infor VISUAL, and Microsoft Dynamics
- •24/7 expert support if anything throws a wrench in the works
Frequently Asked Questions
AS2 Certificates: Common Questions Answered
Do I need a CA-issued certificate or is self-signed acceptable?
+
For most trading partners, self-signed X.509 certificates are perfectly acceptable and take minutes to generate. CA-issued certificates are only required when strict regulatory frameworks or specific enterprise partners mandate them. When in doubt, ask your trading partner's EDI team — they'll specify their requirements upfront.
How do I rotate an AS2 certificate without stopping EDI traffic?
+
The key is running both certificates simultaneously during the transition. Upload your new certificate as secondary while keeping the old one as primary. Once all trading partners confirm they accept the new certificate, promote it to primary and keep the old one on standby for at least 48 hours. This dual-mode approach means EDI traffic never stops flowing during the switchover.
How far in advance should I start a certificate rotation?
+
Start the process at least 30 days before expiry. This gives you time to generate the new certificate, distribute it to all trading partners, allow their IT teams to update their configurations, and complete testing before the old certificate expires. Set calendar reminders at 30 days and 7 days before expiry as a minimum operational standard.
How long should I retain old AS2 certificates?
+
Retain archived certificates for a minimum of 7 years. This covers most regulatory audit windows and allows you to respond to trading partner disputes about historical document exchanges. The certificate archive should be stored securely and accessible on demand — not buried in email folders or decommissioned servers.
What happens if a trading partner is slow to update their certificate?
+
This is one of the most common real-world pain points. The dual-certificate approach protects you — by keeping the old certificate active as a fallback while the new one is being adopted, slow-moving partners don't cause a transmission failure. If a partner consistently delays, having your EDI provider manage the outreach and technical configuration on your behalf removes the bottleneck entirely.
Want stress-free AS2 certificate management?
Talk to an EDI Sumo specialist about your current setup — we handle certificate management, partner outreach, and rotation so you don't have to.
Get a Free EDI Assessment →
