Why did my AWS Transfer Family AS2 traffic stop?

An expired AS2 certificate stops message exchange. Depending on which certificate lapsed — signing, encryption or endpoint TLS — signature verification, decryption or the connection itself fails, so documents stop moving.

How do I fix an expired AS2 certificate in AWS Transfer Family?

Identify the expired certificate and its role, issue a replacement with the same key usage, send the new public certificate to every affected partner with its fingerprint, have each partner import it, then send a test message and confirm a positive MDN.

AS2 certificate expired in AWS Transfer Family

What broke

AWS Transfer Family references certificates via Certificate Manager and partner/agreement config; expiry causes AS2 message failures in CloudWatch logs. The certificate itself is standard X.509 — AWS Transfer Family is just where it's stored and referenced — so the failure and the fix are the same shape regardless of platform:

Signing certificate expired — partners can no longer verify your signature and reject inbound messages (negative MDN).
Encryption certificate expired — partners get decryption failed because they're encrypting to a lapsed key.
Endpoint TLS certificate expired — the HTTPS connection to your AS2 endpoint fails before AS2 logic runs.

Not sure which certificate expired? Paste the public certificate into the inspector — it shows the role (signing / encryption / TLS), the exact expiry date, and the fingerprint, entirely in your browser. Nothing is uploaded.

Recover in the right order

Identify the expired certificate and its role in AWS Transfer Family. Confirm subject, fingerprint and notAfter so you replace the correct one.
Issue the replacement with the same key usage. The private key stays in AWS Transfer Family — it never needs to leave.
Send the new public certificate to every affected partner with its fingerprint, so they can confirm they imported the right file.
Have each partner import and activate it. This is the slow, human step across different portals and contacts.
Send a test message and confirm a positive MDN before calling it resolved.

We don't publish click-by-click menu paths for AWS Transfer Family here — versions differ and a wrong path costs you time mid-incident. The recovery order above is what matters; check AWS Transfer Family's own docs for exactly where its certificate store lives.

Prevent the next one

Expiries surprise teams because no single place tracks every certificate across every partner, and because a rollover has to start weeks early to give partners time to import. Two habits fix that: keep one inventory of every AS2 certificate's expiry, and roll over during an overlap window so no partner is forced to cut over on the exact expiry day. The rollover checklist walks through it.

AS2 certificate expired in AWS Transfer Family

What broke

Recover in the right order

Prevent the next one

Paste the certificate — see its role and expiry