BoostAero XML and CSV Implementation Guideline ... - SupplyOn

SecurityTransport LayerAS2 Settings Requirements ExplanationFor certificate based authentication trusted certificates arerequired. Self created/self signed certificates are NOT allowed.Only trusted certificates from the Trusted/Certificate Authorities(CA) are allowed, e.g.- Symantec/ VeriSignhttp://www.verisign.comIncluding its subordinate brands GeoTrust, Equifax and Thawte- Commodohttp://www.comodo.com- TC TrustCenterhttp://www.trustcenter.deCommunicationCertificateTrustedTrusted: A Certificate Authority (CA) assigns, administratesand controls certificates. SupplyOn requires Class 2certificates.The validity is dependent on the certificate type. As the CA rootcertificates are trusted by SupplyOn the supplier needs toensure that he uses a valid (and not expired) certificate.Otherwise the AS2 connection to SupplyOn would be denied.24 months is the standard certificate validity.Certificate RequirementAS2 and SSL Certificate(key usage: digital signature and encryption)BoostAeroSpace members (BASM) may use X.509 certificatesissued by a BASM internally operated Certificate Authority(BASM PKI) which is compliant with the requirements definedin [BASBCP].- The accepted usage of certificates issued by a compliantBASM PKI is limited to technical M2M connectionsbetween BASM in their role as "M2M Supplier" andSupplyOn unless agreed otherwise.- Test or basic validation certificates (e.g. based on E-Mailaddress or domain verification) issued by the issuingcertificate authority are not accepted for use in productionenvironments. BASBCP Boost Aerospace - BridgeCertificate Policyhttp://www.boostaerospace.com/SMA/BoostAerospaceBridgeCP.pdfDigital Signature _ Digital signature is required.Encryption_No additional encryption of the data is necessary, since thecommunication is already SSL encrypted (HTTPS)!Internetconnection- PermanentInternetconnection- Fixed andpublic URL or IPaddressmandatoryA permanent Internet connection has to be granted.Public 15/59