What is AS2?

AS2 (Applicability Statement 2) is a widely used protocol for securely exchanging business documents over the internet. It is commonly used in Electronic Data Interchange (EDI) environments to transfer documents such as purchase orders, invoices, shipping notices, and inventory reports between trading partners.

AS2 enables organizations to exchange data directly and securely using standard internet technologies while ensuring confidentiality, integrity, authentication, and non-repudiation.

Why is AS2 Important?

Many retailers, manufacturers, logistics providers, and healthcare organizations require their business partners to exchange documents via AS2 because it offers:

• Secure transmission over the public internet
• End-to-end encryption
• Digital signatures for authentication
• Message integrity verification
• Proof of delivery through acknowledgments
• Reduced communication costs compared to legacy VAN networks

How AS2 Works

The AS2 protocol uses the following process:

1. A sender creates an EDI or other business document.
2. The document is optionally compressed.
3. The document is digitally signed.
4. The document is encrypted.
5. The encrypted payload is sent via HTTPS.
6. The receiver decrypts and validates the message.
7. The receiver sends back an MDN (Message Disposition Notification) confirming receipt.

This process ensures that both parties can trust the authenticity and integrity of the exchanged data.

Key AS2 Terminology

Trading Partner

A Trading Partner is an organization that exchanges business documents with another organization via AS2.

Examples:

• Retailer ↔ Supplier
• Manufacturer ↔ Logistics Provider
• Distributor ↔ Customer

Each trading partner maintains configuration information required for communication.

AS2 Identifier (AS2 ID)

An AS2 ID uniquely identifies a trading partner within an AS2 connection.

Example:

Sender AS2 ID: COMPANY_A

Receiver AS2 ID: COMPANY_B

The AS2 IDs are included in every message and must match the values configured by both partners.

Endpoint URL

The AS2 Endpoint URL is the HTTPS address where AS2 messages are delivered.

Example:

https://as2.company.com/as2/receive

Trading partners must exchange and configure their endpoint URLs before communication can begin.

Digital Certificate

A Digital Certificate is used to support encryption and digital signatures.

Certificates contain:

• Public key
• Organization information
• Expiration date
• Certificate authority information (optional)

AS2 commonly uses X.509 certificates.

Public Key

The Public Key is shared with trading partners.

It is used to:

• Encrypt outgoing messages
• Verify digital signatures

Public keys can be distributed without compromising security.

Private Key

The Private Key remains confidential and is stored securely by the certificate owner.

It is used to:

• Decrypt incoming messages
• Create digital signatures

The private key should never be shared.

Encryption

Encryption protects the content of a message from unauthorized access during transmission.

Common encryption algorithms include:

• AES-128
• AES-192
• AES-256

Only the intended recipient can decrypt the message using their private key.

Digital Signature

A Digital Signature proves the identity of the sender and ensures that the message has not been altered.

Benefits:

• Sender authentication
• Message integrity
• Non-repudiation

Common signing algorithms include:

• SHA-256
• SHA-384
• SHA-512

HTTPS

AS2 messages are transported over HTTPS (Hypertext Transfer Protocol Secure).

HTTPS provides:

• Transport-level encryption
• Server authentication
• Secure internet communication

AS2 adds additional message-level security on top of HTTPS.

EDI Document

An EDI Document is the business data exchanged through AS2.

Common document types include:

AS2 itself is transport technology; it does not define document formats.

Payload

The Payload is the actual business document being transmitted.

Examples:

• EDI X12 file
• EDIFACT message
• XML document
• CSV file
• PDF document

AS2 treats the payload as content to be securely delivered.

MDN (Message Disposition Notification)

An MDN is an acknowledgment sent by the receiver after processing an AS2 message.

It confirms:

• Message receipt
• Signature verification
• Successful processing status

MDNs provide proof that a message reached its destination.

Types of MDNs

Synchronous MDN

Returned immediately within the same HTTPS connection.

Benefits:

• Faster confirmation
• Simpler setup

Asynchronous MDN

Returned later through a separate HTTPS connection.

Benefits:

• Better scalability
• Useful for complex processing environments

Non-Repudiation

Non-Repudiation means a sender cannot deny having sent a message.

This is achieved through:

• Digital signatures
• Signed MDNs
• Audit logs

Non-repudiation is often required for compliance and contractual agreements.

MIC (Message Integrity Check)

The MIC is a cryptographic hash generated from the transmitted message.

It allows both parties to verify:

• The message was received intact
• No data was modified during transmission

The MIC value is included in the MDN response.

Compression

AS2 supports message compression before transmission.

Benefits:

• Smaller file sizes
• Faster transfers
• Reduced bandwidth consumption

Commonly implemented using ZLIB compression.

Message Integrity

Message Integrity ensures that data has not been altered during transport.

Integrity is verified using:

• Hash algorithms
• Digital signatures
• MIC validation

Any modification to the message invalidates the integrity check.

Certificate Exchange

Before AS2 communication can begin, trading partners exchange:

• AS2 IDs
• Endpoint URLs
• Public certificates
• Supported encryption algorithms
• Supported signature algorithms
• MDN requirements

This setup process is commonly called Trading Partner Onboarding.

Typical AS2 Configuration Information

When establishing a new AS2 connection, partners usually exchange the following details:

Advantages of AS2

Security

Strong encryption and digital signatures protect sensitive business data.

Reliability

MDNs provide confirmation that messages were received successfully.

Cost Efficiency

Uses the public internet instead of expensive private EDI networks.

Compliance

Supports auditability and non-repudiation requirements.

Industry Adoption

Widely accepted by major retailers, manufacturers, logistics providers, and healthcare organizations.

Summary

AS2 is a secure and reliable protocol for exchanging business documents over the internet. By combining HTTPS, encryption, digital signatures, and MDNs, AS2 enables organizations to automate B2B communication while maintaining high levels of security and accountability.

Understanding core AS2 terminology—including AS2 IDs, certificates, encryption, digital signatures, MDNs, MICs, and trading partners—is essential for successfully implementing and managing AS2 integrations.