Protocole AS4

Fonctionnement de Peppol eDelivery AS4.

Peppol transports every document over the eDelivery AS4 profile: SOAP with attachments, WS-Security signing with Peppol PKI certificates, payload compression and encryption, and mandatory signed receipts (non-repudiation).

Implementation notes:

• The payload is an SBDH-wrapped business document (Standard Business Document Header carries sender/receiver/doctype for routing).
• Receipts are synchronous; a missing or invalid receipt means retry — your sender must implement retry with backoff and duplicate detection.
• Certificates rotate: production and test PKI are separate, and certificate renewal must be automated (expiry is the classic self-hosted outage).
• TLS on the endpoint is required in addition to message-level security.

Building your own AS4 stack only makes sense for Service Providers — see the phase4 and Oxalis guides. Everyone else uses a provider API and never touches AS4 directly.