Removal of eB2B Truststore and PeppolCertificateChecker – clarification on rationale and replacement

[tamndse62381]

Hi Philip,
While upgrading from peppol-commons 10.4.1 → 12.0.4, we noticed that all explicit eB2B references and the PeppolCertificateChecker class (including peppolTestEb2bAP() / peppolProductionEb2bAP()) were removed.

Our current AP and SMP services still operate under the eB2B domain (ECMA France, eB2B G2 PKI) with certificates issued by:
CN=PEPPOL EB2B ACCESS POINT CA - G2, O=OpenPEPPOL AISBL, C=BE
After the upgrade, validation against these certs fails unless we manually inject the eB2B CAs into a custom truststore.

Could you please clarify:
What was the rationale for removing the built-in eB2B truststores and related APIs?
Is there an official replacement or recommended approach for supporting eB2B TEST and PROD CAs going forward?
Should we now maintain our own composite truststore including both Peppol G3 and eB2B CAs?

Thanks a lot for your time and for maintaining the Helger Peppol stack!

[phax]

Hello @tamndse62381 the reason is very simple: OpenPeppol decided, that you don't need to have a specific certificate for the eB2B domain - being OpenPeppol and GENA member as well as signing some additional paperwork is sufficient. You can use the Peppol Post Award certificate for exchanging eB2B certificates.
The certificates were also removed from the official Peppol PKI page.
Hope that clarifies it

[tamndse62381]

Hi Philip,

Thanks for the clarification.

One last question: if we upgrade to peppol-commons 12.0.5, do we also need to change our certificate for the FR environment? Specifically:

PROD: We’re on a standard OpenPeppol G2 AP cert (issuer: PEPPOL ACCESS POINT CA – G2). My understanding is that this remains valid and we don’t need to rotate just because of the library upgrade—migration to G3 would only happen at renewal. Is that correct?

UAT-FR: We currently use an eB2B TEST G2 cert. Since 12.x no longer ships eB2B trust anchors, should we:

switch to an OpenPeppol TEST AP cert (recommended), or

keep a custom truststore that includes the eB2B TEST chain until we swap?

Just want to align library behavior with the current PKI posture.

Thanks again!

[phax]

@tamndse62381

• Regarding the FR certificate: this is not the area with my biggest expertise. I would say yes, but I recommend you reach out to the OpenPeppol ServiceDesk
• Regarding the G2 to G3 migration: the production migration MUST happen between Feb 16th and April 1st, 2026. Please read the official migration guideline from https://openpeppol.atlassian.net/wiki/spaces/OPMA/pages/3977936899/Peppol+PKI+2025+-+Certificate+Authority+Migration+Plan
• Regarding UAT-FR: yes, please switch to Peppol Test AP certificate. Make sure to tell your other testing partners as well.
• hth