Add support for SML certificate update

[phax]

UPDATING THE SML WITH A NEW SMP CERTIFICATE:
PrepareChangeCertificate operation
SMP with expired certificate

PEPPOL_Certificates_Change_V1.2.pdf

[phax]

A generic version is available at https://peppol.helger.com/public/menuitem-tools-smp-sml#tab_updatecert

[emilbokenstrand]

Greetings,

I am sorry that this question is not directly tied to the SMP software but this seemed like the most appropriate place to put it anyway.

I tried https://peppol.helger.com/public/menuitem-tools-smp-sml#tab_updatecert to update our SMP pilot certificate to the newer V3 certificate and get the following error:

Error preparing migration of SMP certificate at SML 'https://acc.edelivery.tech.ec.europa.eu/edelivery-sml'. Technical details: ClientTransportException Der Server hat HTTP-Statuscode 401 gesendet: Unauthorized

and I cannot get further. I believe this error has something to do with the keystore I provide but I cannot figure out what is wrong. The keystore has one entry containing our old (still valid) certificate (complete chain) and the corresponding private key. I tried with an empty password on the keystore and the entry itself without any luck.

Can you please advise how to proceed?

Edit:
I was able to do this with our production certificate where the only difference I can think of is that our production SMP has got no service groups registered yet

Regards, Emil

[phax]

@emilbokenstrand there are multiple things to consider:

• For production use [SML] for test use [SMK]
• The old keystore MUST be the one used in your SMP, including the private key and the full chain. Note: only JKS keystores are support. PKCS 12 does not work here. Your existing certificate may not be expired yet.
• The password must be the one to open the keystore and it assumes, that the password for the key is identical to the one of the whole keystore
• The migration date must be in the future

I assume you matched all the requirements. Maybe we can have a short Skype session where you can share screen. My Skype ID is phelger

[emilbokenstrand]

My bad. I had messed up the new certificate. Sorry for causing any inconvenience, I succeeded in the update now. I made a contact request on Skype btw.

Thumbs up for this fix, nice to have it available directly in the SMP.