AS2: receiving and certificates
This page helps when MicroB2B refuses a partner’s message, and with certificate problems. Each heading is what you see. Below it are the likely causes and what to do. For messages you send, see AS2: sending problems.
The message’s page shows its history, with the reason for each failure. System > Logs, filtered by the message id, shows the details.
Receiving fails
When MicroB2B refuses a partner’s message, the partner gets a receipt that says so. If the partner asked for no receipt, it gets an HTTP error instead: 400 (the message is at fault), 413 (too large) or 500 (a problem on your side). Your side shows the message as Refused or Error if it got far enough to be stored. Its history and the log name the cause. The receipt says less.
| The partner sees | Cause and what to do |
|---|---|
processed/error: unexpected-processing-error, and your log says no local AS2 profile for AS2-To | The AS2-To is not the AS2 ID of any of your organizations. Check the AS2 ID you gave the partner. Nothing is stored |
processed/error: authentication-failed, and your log says no remote AS2 profile for AS2-From | The AS2-From is not the AS2 ID of any partner. AS2 IDs must match exactly, including upper and lower case. Nothing is stored |
processed/error: authentication-failed | The signature does not verify against the Partner Certificate or Additional Partner Certificates, or no partner certificate is set. Upload and choose the partner’s current certificate |
processed/error: authentication-failed, and the log says the signature was received before | A signed message you already have was sent again under another Message-ID. It is a replay, or a partner system that resends without signing again |
processed/error: decryption-failed | The partner encrypted to a certificate that is not one of yours. Send them your current public certificate |
processed/error: insufficient-message-security | The message was not signed or not encrypted, and the profile requires it. Have the partner turn on signing and encryption, or turn off Require Incoming Signatures or Require Encryption for this partner |
processed/error: integrity-check-failed, and the log says the Message-ID was used for a different message | The partner reused a Message-ID for a different document. Each message must have its own |
processed/error: decompression-failed | The content could not be decompressed. The stored received stage shows what arrived |
processed/error: unexpected-processing-error | A problem on your side, such as storage or the database. See the log line before it, and MicroB2B does not start |
failed/failure: unsupported format or unsupported MIC-algorithms | The partner asks for a signed receipt in a form MicroB2B does not support. Have it allow pkcs7-signature and sha256 |
failed/failure: sender-equals-receiver | The partner’s AS2-From is the same as its AS2-To |
| HTTP 503 Service Unavailable | More requests arrived at once than the receiver’s Max Concurrent Requests. The partner resends. Raise the limit if the database keeps up. See AS2 receiver |
| HTTP 405 | Only POST is accepted at the receiver’s path |
HTTP 400 as2: missing required AS2 headers | The request is not AS2: it has no AS2-From or AS2-To |
HTTP 400 as2: invalid AS2 identifier: AS2-From ... | The header is not a valid AS2 ID. It has a character outside printable ASCII, a " or \ inside the name, or an unclosed quote |
The partner cannot reach you at all. The AS2 receiver listens on its own Port and Path, not on the web UI’s port. Check that the port is open in your firewall. In a container, publish the port. See AS2 receiver.
For messages a partner sends twice, see Duplicate messages.
Certificate problems
The upload is refused
| Message | What to do |
|---|---|
unrecognized certificate file | The file is not a certificate in PEM, DER or PKCS#12 format |
PKCS#12 password missing or incorrect | Enter the right password for the .p12 or .pfx file |
the upload contains no certificate | The file holds only a key. Upload the certificate with it |
is an encrypted private key, which is not supported; decrypt it first | Remove the passphrase: openssl rsa -in key.pem -out plain.pem |
A key that matches no certificate in the upload is also refused. Only RSA and ECDSA keys are supported.
A certificate is missing from a picker
Pickers for your signing, decryption, receipt-signing and TLS client certificates list only certificates stored with a private key. Upload the certificate together with its key. Pickers for a partner’s certificates list every certificate.
A certificate is expiring or expired
Configuration > Certificates flags certificates that are expired or expire within 30 days. Filter by Status to find them. MicroB2B also raises a certificate_expiring or certificate_expired alert, at most once a day per certificate. Replace the certificate before it expires. See Certificates.