AS2
Also: Applicability Statement 2 · AS2 connection
AS2 is a standardised method for exchanging business data directly over HTTP. It supports signing, encryption and electronic delivery receipts, and is widely used for EDI connections between companies.
What it is
AS2 stands for "Applicability Statement 2" and is described in RFC 4130. Business data is transmitted over HTTP; in practice security mechanisms such as S/MIME signatures and encryption are applied. Which security functions are actually used is agreed between the partners involved.
A central element of AS2 are Message Disposition Notifications, or MDNs. They acknowledge what the recipient’s AS2 system reports: that the AS2 message arrived and was processed at that end. Whether the data was then validated and posted in the target system is not something an MDN says — that has to be watched separately. With a signed MDN, a cryptographic check value of the received message can be returned as well. That makes it technically verifiable which message the partner acknowledged.
AS2 defines the transport, not the business content. EDIFACT, XML or other structured files can all be carried.
In practice
With AS2, certificates, partner parameters and reachability have to be operated alongside the data processing itself. Certificates have validity periods and must be renewed and exchanged with trading partners in good time. Changes to endpoints, firewalls or proxy configurations can affect the connection too.
A stable AS2 connection therefore takes more than one successful transmission. Failed transfers, expected MDNs that never arrive, and expiring certificates should all be monitored.
Depending on the operating model, the AS2 endpoint is run in-house or obtained as a service. Which option makes sense commercially and organisationally depends on the number of trading partners, internal operating requirements and the existing IT infrastructure.
When it affects you
AS2 is frequently prescribed as the transmission method by retail, industry and other EDI-intensive sectors. For planning, the first question is whether to run your own endpoint or use an existing service.
Before going live, partner parameters, certificates and test messages have to be agreed. The technical connection is generally well standardised; the organisational coordination with the partners involved should nevertheless be planned early.