AS2 certificate checker
Paste or open a trading partner’s AS2 certificate and see who it belongs to, when it expires, how strong its key is and its fingerprints. It runs in your browser; nothing is uploaded.
- PEM, CER, CRT and DER
- Expiry and key strength
- SHA-1 and SHA-256 fingerprints
Everything from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE-----. A chain of several certificates is fine. Public certificates only: never paste a private key.
.cer, .crt, .pem or .der, or drop the file here.
The checker reads the certificate in your browser. Nothing is uploaded, and it does not contact anyone: not your partner, not a certificate authority, not Comparatio. It reads what the certificate says; it does not verify signatures, revocation or a chain to a trusted root.
Background
What AS2 certificates are for
AS2 sends EDI files between trading partners over the internet. Each side has a key pair: a private key that stays on its own AS2 server, and a certificate with the matching public key, which it gives to its partners.
Signing
You sign each file with your private key. Your partner checks the signature with your certificate, so it knows the file came from you and was not changed on the way.
Encryption
You encrypt each file with your partner’s certificate. Only your partner’s private key can decrypt it.
Receipts (MDNs)
Your partner answers each file with a receipt, the MDN, which can be signed the same way. It is your proof that the file arrived.
That is why partners swap certificates when they set up a connection, and again each time one expires. If a certificate expires, or the new one is not loaded on both sides in time, files stop going through.
The checks
What each check means
| Check | What it tells you | What to look for |
|---|---|---|
| Subject and issuer | Who the certificate belongs to (subject) and who issued it (issuer): common name (CN), organization (O), organizational unit (OU) and country (C). | The subject should name your partner or its AS2 system. An unexpected name usually means the wrong file was sent. |
| Self-signed or CA-issued | Self-signed means the subject and the issuer are the same: the owner made the certificate. Otherwise a certificate authority (CA) issued it. | Both are common in AS2. For a CA-issued certificate, your AS2 software may also need the CA’s intermediate and root certificates. |
| Valid from and until | The period in which the certificate may be used, with the days left counted from your computer’s clock. | Expired: files signed with it or encrypted for it can be rejected. Within 30 days: get the replacement and agree the switch date now. |
| Public key | The key algorithm, such as RSA or EC, and its size. | RSA keys under 2048 bits are flagged: they are below current guidance (NIST SP 800-131A). |
| Signature algorithm | The hash the issuer used to sign the certificate, such as SHA-256. | SHA-1 and MD5 are flagged: neither is considered safe for signatures any more. |
| Key usage | What the certificate may be used for, if its issuer restricted it (key usage and extended key usage). | An RSA certificate that signs and receives encrypted files normally lists Digital Signature and Key Encipherment. Not present means not restricted. |
| Fingerprints | The SHA-1 and SHA-256 hashes of the whole certificate. Any change to the certificate changes them. | Compare them with your partner by phone or a separate email before you load the certificate. |
Renewals
When a partner’s certificate is expiring
Certificates expire on a fixed date, weekends included. Swap them before that date, not after the first rejected file.
- 1
Get the new certificate early
Ask your partner for the new public certificate (.cer, .crt or .pem) and the date and time it will switch. Never send or accept a private key.
- 2
Check it here
Confirm the subject, the dates and the key size, and compare the fingerprints with your partner by phone or a separate email.
- 3
Load it and test
Add it to the partner’s AS2 profile before the switch, then send a test file and check that the receipt (MDN) comes back.
When your own certificate is expiring, the same steps run the other way: send every partner your new public certificate and its fingerprints well before the switch date.
For Comparatio customers, AS2 certificates are watched continuously and alerted 30 days before expiry, and the renewal is managed. How proactive monitoring works
FAQ
AS2 certificate questions
Is my certificate uploaded anywhere?
No. The page reads the text you paste, or the file you open, in your browser and runs the checks there; the fingerprints come from your browser’s built-in cryptography. Nothing is uploaded, and the checker does not contact your partner, a certificate authority or Comparatio.
Does the checker tell me whether a certificate is trusted?
No. It reads what the certificate says. It does not verify the signature, check whether the certificate has been revoked, or build a chain to a trusted root. Self-signed here means only that the subject and issuer names are the same.
What if I paste a private key by mistake?
The checker refuses anything that contains the words PRIVATE KEY, and files such as .key, .pfx and .p12, without decoding them, and empties the box. A private key should never be shared, emailed or pasted into a website. If it has been sent to someone, have a new key and certificate made and send your partners the new certificate.
Which files can I check?
PEM text (-----BEGIN CERTIFICATE-----), and .cer, .crt, .pem and .der files in PEM or binary DER form. A PEM file holding a whole chain is read certificate by certificate. A .p7b bundle has to be opened in your operating system’s certificate viewer first, and each certificate exported as a .cer file.
Is the signature algorithm shown the one my AS2 connection signs with?
No. It is the algorithm the issuer used to sign the certificate itself. The algorithm used to sign each AS2 file and receipt, for example SHA-256, is set in the AS2 profile you agree with your partner.
Why are there two fingerprints?
Some AS2 software shows the SHA-1 fingerprint (Windows calls it the thumbprint), newer software the SHA-256 one. Both are calculated from the same certificate; compare whichever your partner’s software shows.
AS2 certificates, watched for you
Comparatio watches AS2 certificates continuously, alerts 30 days before expiry and manages the renewal.