Urgent: ALYF Banking EBICS Verify Bank Keys fails with ASN.1 certificate parsing error

[salsabil-27]

Hello ALYF team,

we are using ALYF Banking on ERPNext/Frappe v16 and are blocked during EBICS bank key verification.

System:

Frappe: 16.12.0
ERPNext: 16.11.0
ALYF Banking: 16.0.0
Bank: LBBW / Landesbank Baden-Württemberg
Action: EBICS User → Verify Bank Keys
EBICS order: HPB / download bank keys

The bank confirmed that the current EBICS participant/user is active. The EBICS User in ALYF is initialized and configured with the active user, but “Bank Keys Activated” is still not checked.

When clicking “Verify Bank Keys”, the request fails during client.HPB() while parsing the bank certificate:

ValueError: error parsing asn1 value: ParseError { kind: InvalidValue, location: ["Certificate::tbs_cert", "TbsCertificate::validity", "Validity::not_after", "Time::GeneralizedTime"] }

Traceback path:
apps/banking/banking/ebics/doctype/ebics_user/ebics_user.py
→ manager.download_bank_keys()
→ client.HPB()
→
→ _parse_certificates

We tested on staging:

fintech 7.9.1 + cryptography 48.0.0: same error
fintech 7.9.2 + cryptography 48.0.0: same error
fintech 7.9.2 + cryptography 46.0.3: same error
fintech 7.9.1 + cryptography 46.0.3: same error
certificate-related EBICS setting tested on staging: same error

We are not including Partner ID, User ID, IBAN, EBICS URL, passphrase, INI letter, or key material in this first support request for security reasons.

Could you please confirm whether this is a known issue with LBBW/BW-Bank certificates, and whether there is a patch or workaround for the fintech EBICS parser?

Thank you.

[joonis]

LBBW uses non-standard certificates with EBICS 3.0 (H005) that are not accepted by cryptography v35.0.0+ due to invalid timestamps. Workaround: Either downgrade the cryptography package to v3.4.8 or use EBICS 2.5 (H004).

See: https://www.joonis.de/en/fintech/banks/#bic=SOLADEST600

[barredterra]

@salsabil-27 Is using EBICS 2.5 (H004) an option for you? I wouldn't want to downgrade the cryptography package.

You can either use the menu button "Actions" > "Change Protocol Version" on your existing EBICS User, or set Protocol Version to "H004" on a new EBICS User.

[joonis]

By the way, the bank already knows about this issue. But the certificates have not been renewed since the issue was reported in August 2025. You could contact the bank again.

[salsabil-27]

@salsabil-27 Is using EBICS 2.5 (H004) an option for you? I wouldn't want to downgrade the cryptography package.

You can either use the menu button "Actions" > "Change Protocol Version" on your existing EBICS User, or set Protocol Version to "H004" on a new EBICS User.

The existing EBICS User already showed Protocol Version H004. We also changed/confirmed the protocol version to H004 again and retried Verify Bank Keys, but the error is still exactly the same:

ValueError: error parsing asn1 value: ParseError { kind: InvalidValue, location: ["Certificate::tbs_cert", "TbsCertificate::validity", "Validity::not_after", "Time::GeneralizedTime"] }

So H004 on the existing initialized EBICS User did not solve the issue.

[joonis]

So the user was also initialized with protocol version H004 from the beginning?
What was printed on the INI letter? Keys or certificates?

[salsabil-27]

So the user was also initialized with protocol version H004 from the beginning? What was printed on the INI letter? Keys or certificates?

The letter contains public keys, not certificates. The visible key sections are:

Electronic signature key
Authentication key
Encryption key

The EBICS User currently shows Protocol Version H004, and needs_certificates is not enabled.

[joonis]

That is somewhat strange, because with protocol version H004 usually no certificates are transferred from the bank to the client. Could you enable debug logging, try again and send the logs to info@joonis.de? Thanks.

[joonis]

@salsabil-27 Thank you for the log. The bank indeed transfers the certificates with H004 as well.

In this case you have to downgrade the cryptography package to v3.4.8. After the retrieval of the bank keys (HPB) you can manually remove the certificate data for all bank keys from the key file, by setting certs to empty lists:

...
"certs": []
...

Then it should be possible to update the cryptography package to the previous version again. But you have to continue using EBICS 2.5 (H004).

I'm still in contact with the bank. They should really update their certificates...

[joonis]

According to the bank, the certificates will be renewed next year in November 2027.