AS2: sending problems
This page helps when an AS2 message to a partner fails, or when a partner’s receipt (MDN) is rejected. Each heading is what you see. Below it are the likely causes and what to do. For messages from a partner and certificate problems, see AS2: receiving and certificates.
The message’s page shows its history, with the reason for each failure. System > Logs, filtered by the message id, shows the details.
Start with Test Connection
If you are not sure where the connection to a partner fails, open the partner’s page and choose Test Connection in its AS2 section. The check names the step that fails: the certificates, the name lookup, the connection, TLS or the HTTP request. It also shows the certificate the partner’s server presented. You can send a test message from the same page. See Testing a partner.
Sending fails
The AS2 sender retries a failed send up to Max Retries times, waiting longer each time. The partner’s AS2 profile can set its own retries and wait. After the last try, the message is Error with max retries exceeded: .... See AS2 sender.
the request failed: ... or no answer within ...
The message is like the request failed: connect: connection refused, the request failed: no such host or no answer within <time>. The partner’s Endpoint is wrong, or the MicroB2B server cannot reach it. The message leaves out the address on purpose. Test it with curl from the same server. Check your firewall’s outgoing rules too.
A TLS handshake or certificate error
The partner’s HTTPS server uses a certificate your server does not trust. Upload the partner’s CA certificate, or its self-signed server certificate, and add it to Partner’s TLS Server Certificates. TLS 1.2 or newer is required. See AS2 security.
received non-success status: 500 Internal Server Error
The partner’s server rejected the message. Its log says why. Ask the partner.
The history names MDN Notification To
The message is cannot request an MDN from partner "X": the organization's AS2 profile "Y" has no MDN Notification To. Set MDN Notification To on your organization’s AS2 profile. Or set Request MDN to None on the partner’s profile.
The history names MDN Receipt Delivery Option
The message is cannot request an asynchronous MDN ... has no MDN Receipt Delivery Option. A receipt sent later (asynchronous) needs two things:
- The URL partners send receipts to, in MDN Receipt Delivery Option on your organization’s AS2 profile.
- An AS2 receiver whose MDN Callback Path is that URL’s path.
Or set Request MDN to Synchronous on the partner’s profile. See AS2 receipts.
The history says no AS2 profile was found
The message’s organization or partner has no AS2 profile. Add one.
signing certificate N (...) has no private key
The certificate chosen to sign was uploaded without its private key. Upload the certificate and its key together, and choose that one. The same goes for our TLS client certificate N (...) has no private key.
additional HTTP header "..." ...
An entry in the profile’s Additional HTTP Headers is malformed, or sets a header that AS2 sets itself. Fix or remove it.
failed to load the payload of message ...
The stored content of the message is missing. See the storage section of MicroB2B does not start.
The partner’s receipt is rejected
MicroB2B checks a receipt sent in the same connection (synchronous) against the message it sent. If the receipt does not confirm delivery, the message is Error at once with synchronous MDN: <reason>. It is not retried. Fix the cause, then send the message again: Redeliver the delivery, or send the file again from its source.
| Message | Meaning and what to do |
|---|---|
synchronous MDN from "X" does not confirm delivery: ... | The partner refused the message. The text after the colon is theirs. authentication-failed, decryption-failed or insufficient-message-security mean their security settings differ from the partner profile here. Compare them with the partner |
as2: the partner answered a message that asked for a synchronous MDN without one | The partner’s system does not send receipts in the response. Set Request MDN to Asynchronous or None |
as2: the MDN has no Received-content-MIC for a signed receipt, ... does not match the message sent, ... uses an unsupported algorithm | The receipt does not prove the partner received the right content. The message’s page shows both checksums (MICs). Often the partner signed with another algorithm than Signature Algorithm |
as2: the MDN is for a different message than the one sent | The partner’s system answered with another message’s receipt. Ask the partner |
no certificate configured for this partner's MDN signatures and no system trust store | A signed receipt cannot be checked. Choose the Partner Certificate, or Partner MDN Signature Certificates |
The receipt’s signature does not verify. The partner signs with a certificate that is not its Partner Certificate. Add the certificate to Additional Partner Certificates. If the partner signs receipts with a different certificate than messages, add it to Partner MDN Signature Certificates.
Asynchronous receipts arrive at your AS2 receiver, at its MDN Callback Path. Until one arrives, the message is Awaiting receipt. A refused receipt is logged with one of these:
async MDN callback missing required AS2-From or AS2-To header... from an unrecognized partner... signature verification failed... does not match any outgoing message