Deploy to your server

OpenAS2 needs a Java Runtime (JRE 11 or newer). Check if you already have it:

java -version

If not, install it:

# Debian/Ubuntu
sudo apt install default-jre

# RHEL/CentOS
sudo yum install java-11-openjdk

# macOS (Homebrew)
brew install openjdk@17

Windows: download the installer from adoptium.net and run it.

Get the latest release package from the OpenAS2 project on GitHub:

curl -L -o OpenAS2.zip \
  https://github.com/OpenAS2/OpenAs2App/releases/latest/download/OpenAS2.zip

Or download the ZIP manually from github.com/OpenAS2/OpenAs2App/releases in your browser.

unzip OpenAS2.zip
sudo mv OpenAS2 /opt/openas2
cd /opt/openas2

Key folders you'll work with:

Go to the Export page here and download both files, then copy them over the defaults:

cp ~/Downloads/config.xml /opt/openas2/config/config.xml
cp ~/Downloads/partnerships.xml /opt/openas2/config/partnerships.xml

The exported config.xml already contains your station IDs, ports and certificate references; partnerships.xml carries your trading partners, URLs, encryption and signing rules.

Add your private key and partner public certificates to the OpenAS2 keystore. Patchpoint tracks which cert belongs to which station/partner on the Certificates page — use those aliases:

# Your private key (PFX/P12) — alias must match config.xml
keytool -importkeystore \
  -srckeystore mykey.pfx -srcstoretype PKCS12 \
  -destkeystore /opt/openas2/certificates/as2_certs.p12 \
  -deststoretype PKCS12 -deststorepass changeit

# Partner's public certificate
keytool -importcert -trustcacerts \
  -file partner.crt -alias partner-alias \
  -keystore /opt/openas2/certificates/as2_certs.p12 \
  -storepass changeit

The keystore password is set in the exported config.xml — change changeit to a strong password and update the file to match.

Allow inbound traffic on the port your station listens on (from config.xml, default 10080):

sudo ufw allow 10080/tcp
# or firewalld:
sudo firewall-cmd --add-port=10080/tcp --permanent && sudo firewall-cmd --reload

Give your partner the public URL they should send to, e.g. http://your-server.example.com:10080. For production, use HTTPS (TLS) on port 10443 or front OpenAS2 with a reverse proxy.

cd /opt/openas2
./bin/start-openas2.sh

Watch the startup log to confirm it loaded your config:

tail -f /opt/openas2/logs/openas2.log

You should see your station IDs and partnerships listed with no errors. To run it as a service, create a systemd unit pointing at the same start script.

First run a simulated send in Patchpoint's Test Console to confirm the partnership rules are consistent, then send a real file from your server:

# Drop a file in the station's outbox for that partner
cp test.txt /opt/openas2/data/<station>-<partner>/outbox/

# Watch it go out and the MDN come back
tail -f /opt/openas2/logs/openas2.log

A successful exchange ends with a received MDN (the AS2 receipt). If it fails, the log line names the stage — usually a certificate alias mismatch or a blocked port.