EN

Home / Knowledge / OFTP2

What is OFTP2, and what do you need for it?

OFTP2 is the transmission protocol the automotive industry uses to exchange EDI files over the internet. Its full name is Odette File Transfer Protocol version 2, and it is described in RFC 5024. If a vehicle manufacturer or a large supplier asks you for “EDI over OFTP2”, you need three things: OFTP2 software, an Odette ID and a certificate. On top of that come your partner's connection details.

Last updated 18 October 2026 · fokus it solutions, Jens Musleh

Where OFTP2 comes from

Odette is the European automotive industry's organisation for supply chain and data exchange standards. The OFTP2 specification is developed and maintained there by the “OFTP2 Experts Group”. Odette itself does not sell software; that comes from technology providers. According to Odette, OFTP2 is the most widely used protocol in the automotive industry for exchanging business-critical data over the public internet.

The original ODETTE-FTP dates from 1986 and ran over networks such as X.25 and ISDN. Version 2 was published in 2007 as RFC 5024 and is designed for the internet. New features were:

  • encryption of the connection with TLS (Transport Layer Security, the same method as HTTPS)
  • mutual authentication with certificates
  • encryption and signing of individual files
  • compression
  • signed acknowledgements of receipt

OFTP2 only transfers files. What is in the file is a separate question: usually a delivery schedule, a despatch advice or an invoice in VDA or EDIFACT format (see VDA and Global standards).

How an OFTP2 session works

One side opens a TCP connection to the other. RFC 5024 defines two fixed ports for this: 3305 for unsecured connections and 6619 for connections with TLS. OFTP2's security features rely on TLS, so on port 6619.

Once the connection is established, both sides log on with the SSID command (Start Session). It contains each side's Odette ID and a password the partners have agreed beforehand. Only then do the files follow. Each file starts with SFID (Start File). This command gives the file name, date and time, format and size, as well as the file's sender and recipient, again as Odette IDs.

If a transfer is interrupted, OFTP2 restarts from the last confirmed point. With large files and unstable lines, this saves time and duplicate transfers.

Odette ID and certificate

For every OFTP2 connection, you need two things that you apply for from third parties: an identifier and a certificate.

The Odette ID as your address in the OFTP2 network

In RFC 5024, the Odette ID is called the “Identification Code”. It is 25 characters long and structured according to ISO 6523:

Position Length Content
1 1 “O” for an identifier issued by Odette
2 to 5 4 International Code Designator (ICD), meaning the numbering scheme the identifier comes from
6 to 19 14 organisation identifier
20 to 25 6 subaddress for a specific system within the company

The subaddress is useful if a company runs several OFTP2 systems, for example one for testing and one for production. Odette issues its own codes through the Odette ID Service. For pure OFTP2 servers, there is the “OFTP Code”; according to Odette, it costs €175 (as of 16 October 2026). Some partners also accept identifiers based on other numbering schemes. What your customer requires is stated in its implementation guide. More on identifiers in general: GLN and other identifiers.

Certificates and the Odette CA

OFTP2 uses X.509 certificates, the same technology as for websites. The certificate is used for the encrypted connection (TLS), for encrypting files and for signatures. Odette requires a certificate from a certification authority listed on the Odette Trust Service Status List (TSL).

Odette runs one of these authorities itself: the Odette CA. Certificates are not available off the shelf there. A registration authority checks every application before the CA issues the certificate. Odette states €180 per year for a term of 1, 2, 3 or 4 years (as of 16 October 2026).

In practice, this means that before the first connection, you and your partner exchange public certificates. If a certificate expires, the connection stops. That is why monitoring expiry dates is part of operation. With PDX (Partner Details Exchange via XML), Odette describes a method that allows partners to exchange connection details and new certificates automatically; not every software product supports it.

The EERP acknowledgement of receipt

Once the file has reached its destination, the recipient sends back an EERP (End to End Response). The sender then knows that the file has arrived and can close its copy. If requested when sending, the EERP is signed and serves as proof. If the recipient cannot process the file, it reports this with an NERP (Negative End Response).

For you as a supplier, the EERP matters: without it, you cannot be sure that your despatch advice has reached the customer before the lorry is at the loading bay. The AS2 equivalent is called MDN (see AS2 explained).

What you need for OFTP2 as a supplier

  1. OFTP2 software that runs around the clock, because delivery schedules also arrive at night.
  2. An Odette ID, either your own or as specified by the customer.
  3. A certificate from an authority on the Odette list, with a plan for renewal.
  4. Reachability: a fixed public IP address or a fixed DNS name and, if the partner connects to you, an open inbound port 6619 in your firewall.
  5. Your customer's partner profile: its Odette ID, address and port, passwords, its certificate and the rules for file names and acknowledgements. These details come with the EDI implementation guide or a registration form.

Before going live, there is almost always a test with the partner: first a connection, then test files, then sign-off.

Odette-tested software

Odette regularly tests OFTP2 products against defined test cases for conformance with RFC 5024 and interoperability with reference systems. The register on odette.org only lists products that passed the most recent tests; only the OFTP2 functions are tested. On 16 October 2026, it listed more than 20 providers.

According to Odette, tested software is “increasingly” a condition in vehicle manufacturers' tenders, in some cases as a requirement for their suppliers. So ask your customer early on whether it requires listed software.

OFTP2 with edi-service.eu

edi-service.eu includes OFTP2 as a transmission method, together with AS2, SFTP, HTTPS and email (overview: EDI transmission methods). To be clear: the OFTP2 component we use is not in Odette's register of tested software. If your customer explicitly requires listed software, we will clarify this with you before any contract. What the price covers is set out under Price.

Frequently asked questions

How much does OFTP2 cost?

The protocol itself is openly specified and costs nothing. Costs arise for software, the Odette ID (OFTP Code €175 according to Odette) and the certificate (€180 per year from the Odette CA), each as of 16 October 2026. On top of that comes the effort of setup and testing with each partner.

Which port does OFTP2 use?

Port 6619 is defined for OFTP2 with TLS, and port 3305 without TLS. If your partner connects to you, the port must be open for inbound traffic in your firewall. If only you open the connection, an outbound rule is enough.

Do I need a certificate from the Odette CA?

Not necessarily. Odette requires a certificate from an authority on the Odette list of trusted certification authorities, and the Odette CA is one of them. Some partners specify the authority in their implementation guide.

What is the difference between OFTP2 and AS2?

Both transfer EDI files securely over the internet. OFTP2 runs over its own TCP connection and is widespread in the automotive industry; AS2 runs over HTTP and is not tied to any industry. Which method you use is usually decided by your customer.

Can I use OFTP2 without a fixed internet connection?

Only to a limited extent. If your partner sends files to you actively, it needs a fixed address at which your software can be reached. Without a fixed address, you would have to collect files yourself, and your partner has to support that.

Would you like to know whether your OFTP2 connection is feasible with edi-service.eu? Send an enquiry

Sources

Send an enquiry · FAQ · All knowledge pages