OpenAS2

Search the Azure Marketplace for OpenAS2, select the SecureAnyCloud publisher, and click Create. Configure the Network Security Group to allow TCP 10080 (inbound AS2 messages) from your trading partners and TCP 22 for administration.

RG="as2-prod"; LOCATION="eastus"; VM_NAME="openas2" IMAGE_URN="sac1647283583153:openas2-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION"
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:openas2-ubuntu-24-04:default:latest
az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$IMAGE_URN" \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values "$SSH_KEY" \
  --public-ip-sku Standard
# Open the AS2 receiver and admin ports on the VM's NSG:
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 10080 --priority 1001
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 22 --priority 1002

On first boot the image generates the per-VM AS2 keystore and keystore password and renders them into the OpenAS2 configuration. It also exports your own AS2 public certificate, resolves the VM address for the receiver URL and writes /root/openas2-credentials.txt. This completes within a minute.

SSH in as azureuser and read the details:

sudo cat /root/openas2-credentials.txt

The file records the per-VM keystore password, the local AS2 station id, the AS2 receiver URL and the path to your public certificate.

Check that openas2.service is active, the AS2 receiver is listening on port 10080 and the MDN receiver is listening on port 10081. The H2 tracking TCP server on port 9092, which upstream protects only with a default password, is deliberately not listening.

systemctl is-active openas2.service
sudo ss -tln | grep -E ':10080 |:10081 '
sudo ss -tln | grep -q ':9092 ' && echo "H2 exposed" || echo "H2 tracking TCP server not exposed (secure by default)"

Verify that the vendor demo keystore is gone and that a fresh per-VM keystore exists, owned by the openas2 service user.

test -e /opt/openas2/config/as2_certs.p12 && echo "demo keystore present" || echo "demo keystore removed (secure by default)"
sudo stat -c 'per-VM keystore: %n perms: %a owner: %U:%G' /var/lib/openas2/as2_certs.p12
sudo grep -E '^AS2_LOCAL_STATION_ID=|^AS2_RECEIVER_URL=' /root/openas2-credentials.txt

The image ships a ready-to-run MyCompany to PartnerA partnership that loops back to the local AS2 receiver. Run the self-test helper to drop a payload into that partnership's outbox.

OpenAS2 signs and encrypts the payload and POSTs it to its own receiver. The receiver decrypts and verifies it and writes it to the inbox. A signed MDN receipt is returned and written to disk. This exercises the full signed and encrypted AS2 message and MDN flow end to end.

sudo /opt/openas2/bin/openas2-loopback-selftest.sh

Then inspect the results on disk: the decrypted message in the inbox and the signed MDN receipt.

sudo ls -1 /var/lib/openas2/data/MyCompany_OID-PartnerA_OID/inbox/ | tail -3 sudo find /var/lib/openas2/data/MyCompany_OID-PartnerA_OID/mdn/ -type f | tail -3

The per-VM keystore holds the private keys for your local AS2 stations. Read the keystore password from the credentials file to list its entries, then view the public certificate that you share with a trading partner.

KSPW="$(sudo grep '^AS2_KEYSTORE_PASSWORD=' /root/openas2-credentials.txt | cut -d= -f2-)" sudo keytool -list -keystore /var/lib/openas2/as2_certs.p12 -storetype pkcs12 -storepass "$KSPW"
sudo openssl x509 -in /var/lib/openas2/mycompany-as2-public.cer -noout -subject -issuer -dates

To exchange messages with a real partner, swap public certificates and define a partnership. First, send the partner your public certificate:

sudo cat /var/lib/openas2/mycompany-as2-public.cer

Next, import the partner's public certificate into the keystore under an alias, then define the partner and the partnership. These commands use your own values, so run them yourself:

# Import a partner's public certificate under an alias:
sudo -u openas2 /opt/openas2/bin/import_public_cert.sh <partner.cer> <alias>
# Define the partner and partnership by editing the partnerships file:
sudo -u openas2 nano /opt/openas2/config/partnerships.xml

In partnerships.xml, add a <partner> for the trading partner, with their AS2 id and the x509_alias you imported. Then add a <partnership> that names your station as the sender and theirs as the receiver. Set their as2_url and the encrypt and sign algorithms you have agreed. OpenAS2 reloads the partnerships file automatically.

OpenAS2 sends files by watching an outbox directory. It signs and encrypts any file placed in a partnership's outbox, delivers it to that partner's as2_url and stores the returned MDN as proof of delivery. The shipped loopback partnership sends anything dropped into its outbox to the local receiver:

echo "sac AS2 send demo $(date)" | sudo tee /var/lib/openas2/data/outbox/PartnerA_OID/order-demo.edi >/dev/null
sudo chown openas2:openas2 /var/lib/openas2/data/outbox/PartnerA_OID/order-demo.edi sleep 12
sudo find /var/lib/openas2/data/MyCompany_OID-PartnerA_OID/mdn/ -type f | tail -1

The MDN receipt written for the file confirms that it was delivered and acknowledged. For a real partner, the outbox path follows the pattern data/outbox/<receiver AS2 id>/.

OpenAS2 tracks every message and MDN in an embedded database and logs it. The daily log at /var/lib/openas2/logs/log-<date>.txt records send, receive and MDN events. Received messages and MDN receipts accumulate on disk:

sudo ls -lt /var/lib/openas2/logs/ echo "Messages received:";
sudo find /var/lib/openas2/data -path '*/inbox/*' -type f | wc -l echo "MDN receipts written:";
sudo find /var/lib/openas2/data -path '*/mdn/*' -type f | wc -l

Restrict the NSG. Allow TCP 10080 only from the trading partners that need to send to you, and TCP 22 for administration only. AS2 security is certificate-based, so the receiver is safe to expose to your partners, but a tight NSG is still good practice.

Swap certificates out of band. Exchange public certificates with each partner through a trusted channel before you enable a partnership. Reject unsigned messages for partnerships that require signing.

Protect the per-VM keystore password. It is unique to this VM and stored only in /root/openas2-credentials.txt (mode 0600). Back it up securely, because it protects the private keys of your AS2 stations.

Consider AS2 over HTTPS. For exchange over the public internet, you can enable the HTTPS receiver on port 10443 with a TLS certificate, in addition to message-level signing and encryption.

Keep the OS patched. Unattended security upgrades remain enabled on the running VM.

OpenAS2 is developed by the OpenAS2 project and distributed under the GNU General Public License v3.0. This SecureAnyCloud image builds the unmodified upstream OpenAS2 v4.8.3 release.

SecureAnyCloud provides the packaging, the removal of the demo keystore and default passwords, the per-VM keystore and password generation on first boot, the ready-to-run loopback self-test, and 24/7 support with a guaranteed 24 hour response SLA.

SecureAnyCloud is not affiliated with or endorsed by the OpenAS2 project. OpenAS2 is a mark of its respective owner and is used here only to identify the software.

Deploy on Azure

Find OpenAS2 on Ubuntu 24.04 LTS on the Azure Marketplace, published by SecureAnyCloud. Deploy from the Portal or the Azure CLI as shown above.

Need Help?

Email sales@secureanycloud.com for deployment help, configuration questions, or licensing enquiries.

Deploy on Azure

Launch OpenAS2 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com