Upgrading G2 -> G3 certificate

[tonytram]

Hi @phax ,

I'm still unsure if I understood correctly what is Peppol Official page announcing about timeline to move from G2 -> G3.

Currently, our Test system upgraded G2 -> G3 for both AP and SMP certificates.
And we also passed:

1. PKI Migration eDelivery - G2.
2. PKI Complete Migration eDelivery - G3

My question is that, from now on, our Production can update to G3 for both AP and SMP certificates. And after 1st April (T2) only use new PKI (DOTL) as a truststore (the legacy one should be removed). Am I understood correctly?

Thank you,
Best regards.

[phax]

Hi @tonytram
Please see #334 for the "what".
Please perform the PKI changes in production asap.

To be resilient, I propose to not remove the G2 certificates as trusted from April 1st - wait until you are sure that everybody that is sending to you updated properly.

[tonytram]

Thank you for your quick and helpful response.

[daweedm]

Hi @phax
Don't you think we risk a compliance warning note from OpenPeppol by accepting both G2 and G3 after April 1st ?
The migration plan clearly states that after T2 SP must not trust G2 stores

[phax]

No I don't think that. OpenPeppol has no way of controlling that. It is only a resilience effort from your side. The key element is to securely exchange documents. As long as the signers G2 certificate is still valid, you are okay.