Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  • After 2018-09-03 00:00:00 all Access Points in the network MUST entrust both the current PKI infrastructure and the new PKI infrastructure. Transactions can still be sent using ANY PKI infrastructure.
  • After 2018-11-30 23:59:59 all Access Points in the network MUST only send and receive transactions using the new PKI infrastructure.
  • The needed Root and Intermediate CAs are available for download here
  • You will be contacted when it is your turn to enroll for a PKI v3 certificate.

...

  1. After C1 the operational office of OpenPeppol will commence issuing of PKI v3 certificates.
  2. Up until date T1;
    1. All APs MUST be able to exchange transactions using the PKI v2 certificates. 
    2. All SMPs MUST support PKI v2 certificates.
    3. SML MUST support PKI v2 certificates.
    4. PEPPOL Directory MUST support PKI v2 certificates.
  3. After date T1 and until date T2;
    1. All APs MUST be able to initiate a transaction (send) using ANY of the two available PKI certificates (v2 or v3).
    2. All APs MUST be able to support receiving transactions initiated using BOTH available PKI certificates (v2 and v3).
    3. All SMPs MUST support BOTH available PKI certificates (v2 and v3).
  4. Before C2;
    1. All (operational before T1) AP and SMP providers will have been issued certificates from the PKI v3 infrastructure (this is an internal OpenPeppol deadline).
  5. After date T2;
    1. All APs MUST only exchange transactions using PKI v3 certificates.
    2. All SMPs MUST only support PKI v3 certificates.

C1 = 2018-04-18 16 00:00:00

T1 = 2018-09-03 00:00:00

C2 = 2018-10-31 23:59:59

...

The needed Root and Intermediate CAs are available for download here



Access PointSMP

PEPPOL Directory

SMLOpenPEPPOL

SendingReceivingServerClient


No later than T1
  • Must be able to validate MDNs signed with PKI v3.
  • MUST accept an incoming transaction signed with either PKI v2 or PKI v3.

  • Must accept responses signed with PKI v2 and v3
  • MUST accept SMP client certificates for both PKI v2 and v3.
  • MUST accept SMP client certificates for both PKI v2 and v3.
After T1 only v3 certificates will be issued.
After C1





All service providers should have a v3 certificate.

No later than T2
  • MUST be able to sign transactions with PKI v3.
  • Must use PKI v3 to sign MDNs
  • MUST update AP configuration with AP certificate PKI v3.
  • Provide PKI v3 SMP certificate to SML operator so they can update their entry.
  • Update all SMP entries to use a PKI v3 AP certficate
  • Must use PKI v3
  • Must use PKI v3
  • Must use PKI v3

After T2
  • Disable PKI v2 support
  • Disable support for receiving transactions signed with PKI v2.
  • Disable PKI v2 support
  • Disable PKI v2 support
  • Disable PKI v2 support
  • Disable support for SMP client PKI v2 certs.

...