We are facing a weird situation for few trading partners when they send EDIINT to us. Our Public and Intermediate certificate is SHA-256, however the Root certificate is SHA-1 signed. Trading partner uses Colo AS2 software to send to us. The inbound request to us is Encrypted, signed and receipt requested. MDN Receipt is signed and MIC algorithm is SHA-1.
When the partner uses the above mentioned configuration settings to send to us EDIINT everything works fine. However as we are on SHA-256, we are wanting partner to use MIC algorithm of SHA-256 when sending us. When they use SHA-256, we receive “insufficient-message-security” in MWS transaction. I’m trying to understand on why the communication is still working fine when it is set to SHA-1 though our public certificate is SHA-256 and errors seen when used SHA-256 algorithm.
Any information related to this topic is much appreciated.
I think the TP side they are not sending SHA-256 based cert or some sequence (Root/CA) is incorrect the way your system is expecting and this leads to insufficient message security error.
Did you try to troubleshoot testing both ends how they are sending and receiving to your end as expected?
IS/EDIINT module is IS_9.7_Core_Fix1 ; EDIINT_8.2.1_Fix4 8.2.1.0.18; WmEDIINT_Patch1_20150319 8.2.1.0.18
Also as part of troubleshooting we asked partner to set receipt algorithm to SHA-1 and then transaction processed fine without any errors. So when the partner sends to us they use our public key for encrypting and signs with their private key. I’m still confused on how the results are positive when SHA-1 is used, though our public key is SHA-256.
I believe if you look your root cert does the signature and signature algorithm still show sha1RSA or some thing and that’s why it must have started working once your TP changed it to SHA-1.
True!! Though our public and intermediate certs are SHA-256, the Root cert has Signature algorithm - SHA1RSA; Signature hash algorithm - sha1 ; Thumbprint algorithm - sha1. I see Root cert being SHA-1 for most of our trading partners though the actual public cert is still SHA-256. Is this something common? Also partner certs chain in subject is entirely SHA-1, so that would explain.
Also with this being case is their any vulnerability apart from SHA-1 certs deprecation?
The signature hash algorithm is not tied to the cert’s own hash algorithm. They can be totally different.
Officially, AS2 only support SHA-1 as signature hash algorithm. I think SAG added support for SHA2 in newer version (can’t find it in release notes). Does your TN profile’s extended fields has such option and value: SHA-2? if not, only SHA-1 is supported.