AS2 (Applicability Statement 2) is a protocol for transmitting EDI documents securely over the internet. Each document travels inside an encrypted, digitally signed S/MIME envelope over HTTP/HTTPS, and the receiver returns a signed MDN receipt proving the document arrived intact. That combination — encryption, signature, verified receipt — is why major retailers, Walmart first among them, made AS2 the required connection standard for suppliers.
If a trading partner has told you to "connect via AS2," this page explains what that actually means: where the protocol came from, what happens to a document between your system and your partner's, why the receipt matters as much as the delivery, and the three ways businesses typically get AS2 running.
In this article
What AS2 Is and Where It Came From
AS2 solves a problem that's older than the internet: how do two businesses exchange documents in a way that's secure, verifiable and fast? Its predecessor, AS1, moved EDI documents over email using S/MIME security — workable, but as slow and asynchronous as email itself. AS2 kept the S/MIME security model and swapped the transport to direct HTTP/HTTPS connections, making exchanges real-time.
Three components define the protocol:
- The S/MIME envelope. Each EDI document is encrypted and digitally signed before transmission. Only the intended recipient can decrypt it, and the signature proves who sent it and that nothing changed in transit.
- Digital certificates. Each party holds a certificate used for signing and encryption. Trading partners exchange and validate certificates before the first document moves — which is also why an expired certificate is the classic cause of a suddenly dead AS2 connection.
- The MDN receipt. After decrypting and verifying a message, the receiver returns a signed Message Disposition Notification. This is AS2's defining feature: legal-grade, cryptographic proof of exactly what was delivered and when. Neither party can later dispute receipt — the property known as non-repudiation.
The turning point for adoption came in 2002, when Walmart required its suppliers to move from dial-up VAN connections to AS2. Other major retailers followed, and AS2 has been the dominant point-to-point EDI protocol in North American retail ever since.
How an AS2 Exchange Works, Step by Step
Here's the life of one document — say, an 810 invoice — moving from your system to a trading partner's:
1. The document is prepared and signed
Your EDI system generates the document, computes a digital signature using your private key, and encrypts the whole package using the partner's public certificate. At this point only your partner's system can open it.
2. It transmits over HTTPS
The encrypted package travels directly to the partner's AS2 endpoint over HTTP or HTTPS — no intermediary required, and delivery happens in seconds.
3. The receiver decrypts and verifies
The partner's system decrypts the package with its private key, then verifies your signature: the document came from you, and not a byte changed in transit. If verification fails, the exchange stops here — and both sides know.
4. A signed MDN comes back
The receiving system returns the Message Disposition Notification, digitally signed, confirming successful receipt and integrity. Your system logs it as proof of delivery.
5. No MDN means act now
If the MDN doesn't arrive within the expected window, delivery failed — a certificate expired, an endpoint moved, a firewall rule changed. The absence of the receipt is itself the alert, which is exactly the visibility that email- and FTP-based transfers never provided.
Why Trading Partners Require AS2
The mandate from retailers comes down to four properties working together: security (encryption plus signatures on every document), speed (real-time internet delivery instead of scheduled batch pickups), non-repudiation (the MDN receipt ends "we never got your ASN" disputes before they start) and cost structure (once the connection exists, there's no per-document transmission charge).
One clarification that saves confusion: AS2 and a VAN aren't competitors so much as different layers of the same problem. AS2 is a connection protocol; a VAN is a managed network that can carry your AS2 connections — along with SFTP, FTP and everything else your partner list requires — without you operating the endpoints yourself. Most businesses use one, the other, or both depending on how many partners they have and who mandates what. If you're weighing that decision, our guide to choosing between AS2 and an EDI VAN covers the trade-offs properly.
Three Ways to Get AS2 Running
Whichever path you choose, the ingredients are the same: AS2 software or a service, a digital certificate, certificate exchange with each partner, and firewall configuration for the endpoint. The paths differ in who carries the operational weight:
- In-house AS2 software. You run the endpoint: installing, configuring, monitoring, and — critically — tracking certificate renewals for every partner connection. Full control, and full responsibility; best suited to businesses with dedicated EDI or IT staff.
- Cloud AS2 services. A hosted endpoint managed by a vendor, removing the infrastructure burden while leaving partner-by-partner setup and testing largely with you.
- A VAN with managed AS2. The provider operates your AS2 connectivity alongside every other protocol your partners require, handles certificate management and monitoring, and onboards new partners for you. For businesses without EDI staff, this is usually the shortest path from "Walmart says we need AS2" to documents flowing.
Holding a partner requirement that says "connect via AS2" and not sure what that means for your setup? Ask us — certificates, MDNs and endpoint quirks are daily conversation here, and we're happy to talk it through. No demo, no obligation.
Let's talk AS2Frequently Asked Questions
What is AS2 in EDI?
AS2 (Applicability Statement 2) is a protocol for transmitting EDI documents securely over the internet. It wraps each document in a digital S/MIME envelope — encrypted, digitally signed and delivered over HTTP/HTTPS — and confirms receipt with a signed MDN (Message Disposition Notification), giving both parties legal-grade proof the document arrived intact.
What is an MDN in AS2?
An MDN (Message Disposition Notification) is the digitally signed receipt the receiving system returns after decrypting a message and verifying its integrity. It provides non-repudiation: the sender has cryptographic proof of exactly what was delivered and when, so neither party can later dispute that the document arrived. If no MDN comes back, the sender knows immediately that delivery failed.
Why do retailers like Walmart require AS2?
Walmart drove mass adoption of AS2 in 2002 when it required suppliers to move from dial-up VAN connections to AS2, and many major retailers followed. The appeal is a combination of security (encryption plus digital signatures), real-time delivery over the internet, non-repudiation via signed MDNs, and no per-document transmission costs once the connection exists.
What do I need to set up AS2?
An AS2 setup requires software or a service that implements the protocol, a digital certificate for signing and encryption, certificate exchange with each trading partner, and firewall configuration for the connection endpoint. You can run this in-house with dedicated AS2 software, use a cloud AS2 service, or let a VAN provider manage AS2 connectivity for you alongside your other trading partner connections.
