AS2 Updates: Expiry Alerts and Live Replacement

You can now schedule a replacement AS2 certificate on an active connection, with a takeover date and a grace period. Tediware now also emails you before a certificate in use expires.

Impact: when a certificate is due to expire, or a partner tells you they are rotating theirs, click Schedule replacement on the slot in the connection’s Certificates tab and agree a takeover date with your partner. Old and new certificates are both in place until the grace period ends, so neither side has to switch at the same moment. Changing AS2 IDs, the partner URL or algorithms still means duplicating the connection and activating the copy as a replacement.

Scheduling a replacement:

The new certificate can be one you already imported or one you import from the sheet. The grace period defaults to 14 days and can be set from 0 to 365.
On the takeover date, your messages are signed with your new local signing certificate, and encrypted to your partner’s new encryption certificate. Send your partner the new public certificate before then.
A new local encryption certificate, or a partner’s new signing certificate, is accepted as soon as you schedule it, so the partner can switch early. The old one is accepted until the grace period ends.
When the grace period ends, the old certificate is removed from the connection. You can retire it earlier with Retire now once the new certificate has taken over, or cancel the replacement before the takeover date.
When one certificate fills both slots of a pair, such as local signing and local encryption, you can replace both together.
A local signing certificate used on several connections takes over on one date on all of them. Schedule it on every connection before that date. If you schedule it on another connection after that date, it takes over there immediately, so that partner must already have it.
A takeover date has to fall inside the new certificate’s validity, and a new certificate that expires before the one it replaces is refused.

Expiry emails:

Tediware checks once a day and emails everyone in your organization who receives error notifications 30, 7 and 1 days before a certificate expires, and again when it expires. Each organization gets one email listing every certificate due that day.
An email goes out only for a certificate on an active connection with no replacement scheduled to take over before it expires. It lists each connection still waiting, with a link to its Certificates tab and the certificate’s SHA-256 fingerprint to compare against what your partner has.
The emails stop once every connection using the certificate has a replacement scheduled. A replacement whose takeover date falls after the expiry does not count.
Certificates on connections that are not active, and certificates assigned nowhere, get no email.

GET /platform/connections/:id and the MCP connection_get tool now return the connection’s certificates, one entry per slot and role. A scheduled replacement is role: "successor" with its takesOverAt, and the certificate it replaces carries retiresAt:

{
  "purpose": "local_encryption",
  "role": "current",
  "takesOverAt": null,
  "retiresAt": "2026-11-16T00:00:00.000Z",
  "certificate": {
    "name": "Acme 2026",
    "usage": "both",
    "certificateType": "local",
    "expiresAt": "2026-11-20T00:00:00.000Z",
    "expired": false,
    "fingerprintSha256": "9c41..."
  }
}

Notes and limits:

Scheduling, cancelling and retiring are in the app only. The platform API and MCP can read the slots but not change them.
Expiry emails follow the error notification setting and have no separate switch. Nothing outside email flags an expired certificate yet, beyond the Certificates tab and the connection test.
On a connection whose local signing and local encryption slots hold two different certificates that both have signing and encryption usage, the first replacement on either local slot leaves only the local signing certificate available for signing. Before this change, either certificate could be the one your messages were signed with.

The full procedure is in the connections docs.

This update was written with AI assistance. It has been reviewed and edited by a human.