Guidance on PEPPOL PKI Migration with Oxalis-NG

[JSHapuarachchi]

Hello Team,

We are currently running Oxalis 6.5.0 in our organization, and as part of the PEPPOL PKI Migration we are planning to move to Oxalis-NG.

At the moment, our certificate-related configuration in oxalis.conf under OXALIS_HOME path looks like this:

oxalis.keystore {
    path = "test-cert.p12"
    password = "*******"
    key.alias = "cert"
    key.password = "*******"
}

Our setup is as follows:

• Inbound: Using the vanilla oxalis.war.
• Outbound: A custom wrapper implementation around oxalis-standalone for sending documents.

With the upcoming PKI Migration, we are not entirely sure what changes are required on our side apart from:

1. Upgrading to Oxalis-NG.
2. Updating the keystore configuration in oxalis.conf to point to the new PEPPOL certificates. (we have already obtained the new G3 test certificates)

In addition, we would also like to know how to properly enable the Dual Capability so that we can support both G2 and G3 certificates until the T2 migration phase is completed. We have noticed that in Oxalis-NG v1.2.0-RC6, the release notes mention:

“Peppol PKI 2025: Added Peppol PKI 2025 Truststore for dual capability usage.”

Finally, are there any additional changes or considerations we should be aware of for a smooth migration, including how this dual capability can be configured and used in practice?
If there is any official documentation or migration guide available for Oxalis, it would be very helpful if you could share it with us.

Thank you in advance for your guidance and support.