An AS2 connection is a configured, partner-to-partner channel for sending business documents over the internet using the AS2 protocol. It combines an endpoint URL, two AS2 identifiers, digital certificates, security algorithms and receipt rules in a trading-partner profile.
In practical terms, your ERP or EDI application produces a document, your AS2 service signs and encrypts it, and the partner’s AS2 service returns an MDN receipt. The connection is not simply a username and password. Both organizations must configure matching identities and security requirements before messages can be exchanged.
AS2 connection, AS2 server and AS2 protocol
These terms describe different parts of the same system:
- AS2 protocol: the technical rules for packaging, sending and acknowledging a message.
- AS2 server or gateway: the software that implements those rules.
- AS2 connection: the bilateral configuration between your AS2 system and one trading partner.
One AS2 server can maintain many connections. Each connection should have its own partner endpoint, AS2 ID, public certificate, algorithm policy and contact information. The AS2 protocol guide explains the underlying message exchange; this article focuses on what makes one partner connection work.
What information defines an AS2 connection?
| Parameter | Example | Why it matters |
|---|---|---|
| Local AS2 ID | YOURCOMPANY_PROD | Identifies your organization in AS2 headers |
| Partner AS2 ID | PARTNER_AS2 | Routes the message to the correct partner profile |
| Endpoint URL | https://as2.partner.com/inbound | Destination for outbound AS2 messages |
| Public certificate | Partner encryption certificate | Lets you encrypt so only the partner can decrypt |
| Signing policy | Sign with SHA-256 | Lets the receiver verify origin and integrity |
| Encryption policy | AES-256 | Protects the message content |
| MDN mode | Synchronous, signed | Defines how protocol receipt is returned |
| Payload rules | X12, EDIFACT, XML or other | Tells downstream systems what to process |
The values in your profile must mirror the values at the partner. If their system expects AS2-To: PARTNER_PROD and you send a different value, the server may reject the message before looking at the EDI content.
What happens when an EDI document is sent?
Suppose your ERP creates an invoice for a retailer:
- The EDI layer translates the invoice to the agreed X12, EDIFACT or XML format.
- The AS2 service creates a Message-ID and applies the partner profile.
- It signs the payload with your private key.
- It encrypts the package with the retailer’s public certificate.
- It posts the message to the retailer’s AS2 endpoint.
- The retailer decrypts the message and validates your signature.
- Its AS2 service returns an MDN.
- A translator or ERP then validates the business document and may send a separate EDI acknowledgment.
This distinction prevents a common monitoring error: an MDN can confirm successful AS2 delivery while the invoice still fails business validation. A reliable workflow tracks transport delivery and business acceptance as separate states.
Is an AS2 connection direct?
AS2 supports a direct connection between the two configured endpoints. A managed provider may operate one or both AS2 servers, but the message is still addressed using the agreed AS2 identities and sent to the defined endpoint. This differs from a traditional VAN routing model, where a network service receives, routes and often transforms documents across its own mailbox system.
“Direct” does not mean unmanaged or unsecured. Someone must operate the endpoint, protect private keys, rotate certificates, monitor MDNs and coordinate partner changes. A hosted AS2 service simply performs that operational role on your behalf.
The AS2 vs VAN comparison explains how this bilateral model differs from mailbox and network-routing services.
What AS2 connectivity proves—and what it does not
Connectivity can be tested at several levels:
- DNS resolution proves the hostname can be found.
- A TCP connection proves a port is reachable.
- A TLS handshake proves the HTTPS service and its TLS certificate can negotiate.
- An HTTP response proves the URL answers.
- A valid AS2 MDN proves the protocol message reached a disposition.
- An EDI or application acknowledgment proves downstream processing reached another defined state.
Do not call a connection ready after only an HTTPS check. A real AS2 connection test uses representative signed and encrypted messages, checks the MDN and confirms the business response expected by the partner.
AS2 communication security
An AS2 EDI connection can use several controls together:
- TLS protects the network session.
- AS2 encryption protects the packaged message for the intended recipient.
- A digital signature identifies the signing key and detects modification.
- A signed MDN provides verifiable receipt evidence.
- Message IDs, timestamps and logs support correlation and audit.
The strength of the connection still depends on operations. Private keys must be protected, certificate changes controlled, current algorithms agreed and failures reviewed. Security is a lifecycle, not a checkbox completed during onboarding.
How long does setup take?
Creating a local profile can take minutes. Completing the bilateral connection often takes longer because the trading partner must exchange parameters, approve certificates, schedule tests and confirm production activation. The elapsed time therefore depends more on coordination and partner queues than on the number of fields in the AS2 software.
A controlled process usually includes discovery, parameter exchange, local configuration, connectivity testing, functional EDI testing, production cutover and post-go-live observation. Use the step-by-step AS2 setup guide for that implementation workflow.
Common connection problems
The endpoint is reachable but the message is rejected
Check the exact AS2 IDs, header quoting and whether the request is arriving at the correct test or production route.
The recipient cannot decrypt the payload
Confirm that you encrypted with the partner’s current public certificate and that the partner has the matching private key associated with this profile.
The signature is unknown
Confirm that you signed with the private key corresponding to the public certificate supplied to the partner. Compare certificate fingerprints rather than filenames.
No MDN arrives
Check whether the connection expects a synchronous or asynchronous MDN. For asynchronous mode, validate the return endpoint, firewall path, AS2 IDs and receipt certificate.
The MDN succeeds but the EDI document fails
Move the investigation downstream. Review translator validation, envelope identifiers, control numbers and the partner’s business acknowledgment. The AS2 transport may be working correctly.
The AS2 troubleshooting guide provides a layer-by-layer diagnostic sequence.
Should you host the AS2 connection yourself?
Self-managed AS2 can make sense when your organization already operates high-availability integration infrastructure, has AS2 expertise and can support certificate and incident work around the clock. A managed service is usually attractive when the priority is connecting partners without owning protocol operations.
Evaluate the full workload: endpoint availability, security updates, backups, key custody, certificate rotation, message retention, monitoring, retries, partner support and evidence for audits. Software licensing is only one component.
AS2 connection checklist
Before go-live, verify that:
- test and production profiles are separated;
- both AS2 IDs match exactly;
- certificate fingerprints were verified independently;
- signing, encryption, compression and MIC algorithms agree;
- MDN mode and signature requirements agree;
- representative documents have been tested;
- duplicate, retry and timeout behavior is understood;
- transport and business acknowledgments are monitored separately;
- certificate expiry alerts and support contacts are active.
If you need a partner-facing service rather than an implementation project, AS2Connection supplies a managed AS2 server with your endpoint, AS2 identity, certificates and message tracking.
