AS2 (Applicability Statement 2) is a protocol for sending EDI documents securely over the internet using standard HTTP or HTTPS. It wraps each document in encryption, signs it so the recipient can verify who sent it, and returns a signed receipt (called an MDN) that serves as legal proof of delivery. If a large retailer has told you to connect over AS2, this guide explains what that means, how the connection actually works, and how AS2 compares to the other options you might be weighing.
For the surrounding terminology, our EDI glossary defines every acronym used below.
What is AS2?
AS2 is a transport protocol: its job is to move a file from your system to a trading partner's system safely, and to prove the file arrived intact. It does not define the contents of the file; that is the job of the EDI document standards like X12 and EDIFACT. Think of AS2 as a secured courier for business data. It takes your document, seals it in encryption, signs the seal so the recipient knows it came from you, and hands back a receipt confirming delivery.
What makes AS2 valuable is that it runs over the same HTTP and HTTPS that already flow through your firewalls, so you get bank-grade security for document exchange without leasing a private network. That combination of security, speed, and low ongoing cost is why AS2 became the default for retail and consumer goods supply chains across North America.
How does AS2 work?
An AS2 exchange is a short, structured conversation between two systems. Here is the full journey of a single document, from your ERP to your partner and back.
A document is generated. Your ERP or EDI translator produces an outbound document, for example an EDI 850 purchase order or an EDI 810 invoice. At this point the file is readable and unprotected.
The document is signed. Your AS2 software applies a digital signature using your private key. This is the electronic equivalent of a tamper-evident seal; it lets the recipient confirm the file came from you and was not altered.
The document is encrypted. The software encrypts the signed document with your partner's public key, so only they can open it.
The document is transmitted. The encrypted package is sent to your partner's AS2 endpoint over HTTP or HTTPS.
The partner unpacks and verifies. Their system decrypts the file with their private key, checks your signature against your public key, and confirms the contents match what was sent.
An MDN receipt is returned. Their system generates a Message Disposition Notification, a signed receipt confirming the document was received and readable. This is the proof of delivery that makes AS2 legally defensible.
Two exchanges of public keys and endpoint details happen once, up front, when you and your partner first connect. After that, every document follows the six steps above automatically.
The security model behind AS2
AS2's trustworthiness rests on three mechanisms working together.
Encryption
Encryption transforms your readable document into coded data that only the intended recipient can decode, using their private key. Anyone intercepting the file in transit sees nothing usable. This is what lets sensitive pricing, order, and payment data travel over the public internet safely.
Digital signatures
A digital signature is an electronic fingerprint applied with your private key. It proves two things to the recipient: that the document genuinely came from you, and that nobody changed it along the way. Signatures are the basis for non-repudiation, meaning neither side can later credibly deny that a document was sent or received.
Message Disposition Notifications (MDN)
The MDN is AS2's receipt system, and it is worth understanding in detail because it is what separates AS2 from simpler file transfers.
MDN types:
Synchronous MDNs are returned immediately over the same connection.
Asynchronous MDNs are sent back as a separate transmission, useful when the receiver cannot confirm instantly.
Signed MDNs carry a digital signature for added security and non-repudiation.
How an MDN works:
When sending, the sender requests an MDN in the message headers.
The receiving system processes the message.
The receiver generates an MDN containing the original message ID, the processing status (success or failure), a timestamp, and any error detail.
The MDN is returned to the sender.
Common MDN status messages include "message received/processed" for a clean delivery, "message failed" for a decryption or verification problem, and "message pending" while processing continues, along with specific error codes for troubleshooting.
The business value: a signed MDN gives you undeniable proof of delivery for compliance, an automated audit trail for every exchange, and fast identification of any transmission that failed. Many partners enable both synchronous and asynchronous MDNs for redundancy, use signed MDNs for sensitive transactions, and set timeout and retry rules so a missing receipt raises an alert rather than passing unnoticed.
AS2 certificates
An AS2 certificate is the digital ID card that proves who you are on the network and carries the keys used for encryption and signing. Certificates come in two forms:
Self-signed certificates, created by your own organization.
Third-party signed certificates, issued and verified by a Certificate Authority (CA).
The major CAs that issue AS2 certificates include DigiCert (formerly Verisign), Entrust, GlobalSign, Sectigo (formerly Comodo), and IdenTrust. Most large businesses prefer third-party certificates because they are widely trusted, meet compliance requirements, reduce setup friction with partners, and come with support if something breaks.
Getting a certificate usually follows five steps: create a Certificate Signing Request (CSR), provide proof of your organization's identity, pay the CA's fee, receive your signed certificate, and install it in your AS2 software. You then exchange public certificates with each trading partner during setup.
Setting up an AS2 connection
Establishing an AS2 connection with a partner comes down to exchanging a handful of details and agreeing on a few settings. Each side needs the other's AS2 identifier (AS2-From and AS2-To names), endpoint URL, and public certificate. From there you agree on the encryption and signing algorithms, whether MDNs will be synchronous or asynchronous, and whether MDNs should be signed.
You have three broad options for the software that runs the connection:
Self-hosted AS2 software, which gives you full control and requires you to manage certificates, servers, and every partner connection yourself.
A managed EDI provider, which configures and maintains AS2 and AS4 channels for you, so your team is not troubleshooting handshakes and expired certificates.
An integration platform that bundles AS2 alongside other connectivity methods.
The right choice depends on how many partners you support and how much EDI expertise you want to keep in house. Setup is straightforward for a first connection; the complexity grows with the number of partners and the troubleshooting that comes with them. This is the point where many teams move to a managed service. If you would like this handled end to end, you can start integrating or talk to our team.
AS2 in the EDI workflow
AS2 is the pipe; the documents flowing through it are your everyday EDI transactions. A retailer sends you an 850 purchase order over AS2, you return an 855 acknowledgment and later an 856 advance ship notice, then an 810 invoice. Each of those rides on AS2, and each generates a 997 functional acknowledgment confirming the EDI content was valid. If you are connecting AS2 into your back office, see our guide to EDI ERP integration for how these documents post into your ERP automatically.
How AS2 compares to other EDI communication methods
AS2 is one of several ways to move EDI. Here is how it stacks up against the options you are most likely to consider.
AS2 vs VAN
AS2 | VAN | |
|---|---|---|
Cost model | Upfront setup and certificate costs, then low ongoing cost over your own internet connection | Recurring subscription plus per-volume charges |
Speed | Direct, real-time transmission between partners | Store-and-forward through intermediary servers |
Control | You own the connection and timing | The network sits in the middle |
Security | Point-to-point encryption directly between partners | Secured, but data passes through third-party servers |
Best for | Higher volumes, regular partners, teams with technical resources | Smaller volumes, many occasional partners, or where VAN services like data transformation are needed |
AS2 requires more technical setup than a VAN, since you manage certificates, software, and direct partner connections. In return you remove the monthly network fees and gain direct control over your data flow.
AS2 vs SFTP and FTP
SFTP and FTP can move EDI files, and they are simple, but they lack the two things AS2 was designed to provide: message-level encryption tied to a specific recipient, and a signed receipt proving delivery. With SFTP you secure the channel; with AS2 you secure the individual message and get non-repudiation on top. For partners who require legal proof that a document was delivered and readable, plain file transfer does not meet the bar, which is why retail mandates specify AS2 rather than FTP.
AS2 vs AS4
AS4 is the newer sibling of AS2, and this is a common decision point, so here is the detail.
AS2 | AS4 | |
|---|---|---|
Transport | HTTP/HTTPS | Web services (ebMS 3.0 / SOAP) |
Messaging pattern | Point-to-point (one sender, one receiver) | Multi-hop, message pulling, store-and-forward |
Security | Encryption and digital signatures | Enhanced WS-Security, more encryption methods and security tokens |
Receipts | MDNs for receipt confirmation | More sophisticated receipts, including advanced non-repudiation and status tracking |
Payloads | Typically one payload per message | Multiple payloads per message; splitting and joining of large files |
Adoption | Dominant in North American retail and supply chain | More common in European markets, government, and healthcare |
AS4 is technically more capable, though AS2's simplicity and near-universal adoption make it sufficient for most retail and supply chain work. Teams reach for AS4 when they specifically need its message pulling, multi-hop, or large-file features. A managed provider can run both, so you match each partner to the protocol they require without maintaining two skill sets in house.
What happened to AS3?
AS3 was developed as a possible successor to AS2, using FTP/FTPS instead of HTTP/HTTPS for transport. It looked promising because FTP was familiar, handled large files well, and offered resume capability for interrupted transfers. It never caught on, for a few reasons: by the time it arrived, businesses had already invested in AS2; HTTP/HTTPS proved more firewall-friendly than FTP; security concerns around FTP made organizations cautious; and AS2 kept evolving to meet most needs. Development effort moved from AS2 straight to AS4, and today AS3 is rarely seen.
Common uses of AS2
AS2 is embedded in day-to-day retail and supply chain operations. Companies use it to send purchase orders to suppliers, receive invoices from vendors, transmit advance ship notices, and share real-time inventory. A retail chain might automatically send purchase orders to suppliers when stock runs low, receive shipping notifications as goods move, and process electronic invoices for payment, all over AS2.
Its dominance in retail traces back to the major buyers mandating it. Walmart was an early driver, and Amazon, Target, and thousands of others followed, using direct AS2 to cut costs and speed up communication versus legacy networks. If a specific retailer is asking you to connect, our trading partner directory lists requirements for partners like Walmart, Amazon, and Target. AS2 is heaviest in consumer goods, food and beverage, and apparel, and it also meets legal requirements in regulated fields such as healthcare.
When AS2 is the right choice
AS2 fits well when you exchange regular, high-value documents with established partners, when a partner mandates it, and when you want proof of delivery for compliance. It asks for more technical setup than a VAN and more security than plain file transfer, which is exactly the point for the supply chains that depend on it. The setup effort is a one-time cost per partner; the reliability and the audit trail are ongoing.
If your team would rather not manage certificates, handshakes, and partner-by-partner troubleshooting, a managed EDI provider configures and maintains your AS2 and AS4 channels so you can focus on the business. That is what we do at Surpass. When you are ready, start integrating.
Frequently asked questions
What is AS2?
AS2 (Applicability Statement 2) is a protocol for exchanging EDI documents securely over the internet using HTTP or HTTPS. It encrypts and digitally signs each document and returns a Message Disposition Notification (MDN) as proof of delivery.
How does AS2 work?
Your system signs and encrypts a document, sends it to your partner's AS2 endpoint over HTTP/HTTPS, and the partner decrypts it, verifies your signature, and returns a signed MDN receipt confirming it arrived intact.
What is an MDN in AS2?
A Message Disposition Notification is the signed receipt returned to the sender confirming a message was received and readable. It provides non-repudiation and a legal audit trail. MDNs can be synchronous, asynchronous, or signed.
Is AS2 the same as EDI?
No. EDI is the format of the business documents (such as an 850 or 810). AS2 is one of the ways those documents are transmitted. AS2 carries EDI; it does not replace it.
What is the difference between AS2 and AS4?
AS2 runs over HTTP/HTTPS and handles point-to-point exchange, and it dominates North American retail. AS4 runs over web services, supports multi-hop and multi-payload messaging with enhanced security, and is more common in Europe, government, and healthcare.
Do I need an AS2 certificate?
Yes. Each party needs a certificate to encrypt, sign, and verify messages. You can use a self-signed certificate or one from a Certificate Authority such as DigiCert, Entrust, or GlobalSign; most partners prefer CA-signed certificates.
Is AS2 more secure than SFTP or FTP?
AS2 secures each individual message with encryption and a digital signature and provides a signed proof of delivery, which plain FTP and SFTP do not. That is why retail partners typically mandate AS2 rather than file transfer.
How much does AS2 cost?
AS2 has upfront costs for software and certificates, then low ongoing costs since it uses your existing internet connection rather than a VAN subscription. A managed service bundles setup, monitoring, and maintenance into a predictable fee.
Which retailers require AS2?
Many large retailers require AS2, including Walmart, Amazon, and Target. Check each partner's specification, since exact settings such as MDN type and algorithms vary by partner.
More articles
Our platform is designed to empower businesses of all sizes to work smarter and achieve their goals with confidence.
