An AS2 gateway is the service boundary that connects internal business systems to external trading partners using AS2. It manages partner endpoints, AS2 identities, certificates, signing, encryption, MDNs, retries and transport logs, while exposing simpler interfaces such as an API, webhook, SFTP or watched folder to the ERP and EDI layers.
A gateway does not necessarily translate EDI or apply business rules. Its core job is reliable and secure AS2 communication. Some products bundle translation and managed EDI services, so define the boundary explicitly when comparing options.
Where an AS2 gateway sits
A clean architecture has three layers:
| Layer | Responsibility |
|---|---|
| ERP/business application | Creates orders, invoices, shipments and business decisions |
| EDI/integration layer | Maps formats, validates syntax and orchestrates workflows |
| AS2 gateway | Secures, transports, receives and acknowledges partner messages |
On outbound traffic, the gateway accepts a payload and connection identifier, applies the partner profile, sends the AS2 message and validates the MDN. On inbound traffic, it authenticates the partner, decrypts and verifies the message, generates the MDN and passes the extracted payload downstream.
Partner-profile management
Every partner profile should make the following visible:
- test and production AS2 IDs;
- inbound and outbound endpoints;
- signing and encryption certificate fingerprints;
- certificate validity and planned rotation;
- algorithms and compression;
- synchronous or asynchronous MDN settings;
- content type and filename conventions;
- timeouts, retries and duplicate policy;
- operational contacts and change history.
The gateway should prevent accidental mixing of test and production and record who changed a security-sensitive value. Bulk partner counts are less important than how safely an operator can diagnose one profile at 03:00.
Security capabilities
Evaluate:
- supported signing, encryption and MIC algorithms;
- protection and backup of private keys;
- role-based access and least privilege;
- administrative audit trail;
- single sign-on and multi-factor options;
- payload encryption at rest and retention controls;
- TLS configuration and optional mutual TLS;
- secret rotation for APIs and webhooks;
- isolation between customer or partner profiles;
- vulnerability and patch-management process.
Ask where decryption occurs and who can access cleartext payloads. A checklist of algorithms is useful, but operational controls determine whether those algorithms are used safely.
Certificate operations
Certificate management should be a first-class workflow, not a static upload field. Look for inventory, fingerprints, ownership, expiry alerts, overlap support, scheduled activation and confirmation of the actual certificate used by each message.
The system should let support distinguish an expired certificate from an unknown signing certificate or wrong decryption key. Read AS2 certificates explained for the lifecycle a gateway needs to support.
MDN and evidence handling
A gateway should store more than “delivered.” Useful evidence includes:
- original Message-ID;
- partner and direction;
- transmission attempts and HTTP results;
- MDN disposition and modifier;
- receipt signature status;
- returned and calculated MIC;
- certificate fingerprints;
- timestamps and raw protocol metadata;
- link to business correlation ID.
For asynchronous MDNs, it also needs a reliable receiving endpoint and correlation queue. For synchronous MDNs, timeout and uncertain-delivery behavior must be explicit.
Internal integration options
REST API
Best for application-driven submission, structured status and idempotent automation. The API should return an immutable submission ID and expose protocol evidence without requiring the caller to understand raw MIME.
Webhooks
Useful for near-real-time status. Events should be authenticated, replay-safe and retryable. Consumers need idempotent processing and periodic reconciliation.
SFTP or watched folders
Useful for legacy systems and EDI translators. The gateway should support atomic pickup, archive/error folders, stable naming and machine-readable outcome records.
A gateway can expose more than one option without changing the partner-facing AS2 connection. See the AS2 integration guide for design patterns.
Monitoring and operations
Minimum monitoring should include:
- endpoint and queue health;
- missing MDN threshold;
- negative dispositions;
- signature, decryption and MIC failures;
- repeated retries and duplicates;
- oldest unprocessed inbound message;
- webhook or downstream-delivery failures;
- certificate-expiry thresholds;
- partner-specific error-rate changes.
Alerts need owners and runbooks. A dashboard that turns red without retaining raw evidence or suggesting the failing layer adds little operational value.
Cloud, on-premise and managed gateways
An on-premise gateway runs within infrastructure your organization operates. It can suit strict hosting constraints or deep network integration, but your team owns availability, scaling, upgrades, backups and incident response.
A cloud gateway runs as a hosted service. It can reduce infrastructure work and simplify public endpoint availability, while requiring due diligence on tenancy, data location, security, export and service continuity.
“Managed” describes who performs operations, not only where software runs. A managed service should specify responsibility for partner onboarding, certificate rotation, monitoring and incident resolution. Compare the models in cloud AS2 gateway vs on-premise AS2 server.
Availability and disaster recovery
Ask for the architecture behind the SLA:
- redundant endpoints and failure domains;
- durable inbound and outbound queues;
- backup of profiles, keys and evidence;
- recovery time and recovery point objectives;
- behavior while a partner is unavailable;
- maintenance process and status communication;
- ability to export configuration and messages.
Also test recovery. A theoretical backup is not equivalent to a restored AS2 identity with the correct private keys and partner profiles.
Scalability and limits
Measure partner profiles, messages per unit time, concurrent connections, individual message size, retained payload volume and API/webhook throughput. Ask whether limits are hard, throttled or commercial.
Traffic is often bursty around batch windows. A durable queue and controlled backpressure are usually more important than peak benchmark claims.
Selection checklist
- Does it interoperate with the partner’s required algorithms and MDN behavior?
- Can test and production be separated safely?
- Are private keys protected and recoverable?
- Can certificates overlap and rotate without downtime?
- Are raw MDN, MIC and fingerprint details available?
- Does the internal interface support idempotency and correlation?
- Are retries, duplicates and manual replay controlled?
- Can operators distinguish transport from EDI failures?
- Are retention, audit and data export requirements met?
- Who owns onboarding, monitoring and incidents contractually?
- What happens to identities and evidence if the service ends?
- Does pricing reflect realistic partners, volume, storage and support?
Proof-of-concept test cases
Do not evaluate only a successful small message. Test:
- signed and encrypted messages in both directions;
- synchronous or asynchronous signed MDN;
- MIC validation;
- maximum realistic file size;
- duplicate and retry behavior;
- certificate replacement;
- invalid AS2 ID and unknown certificate;
- internal API/webhook or file-delivery failure;
- evidence export and operator diagnosis.
The AS2 connection test plan provides detailed pass criteria.
Gateway or full managed EDI service?
Choose a gateway when you already control mapping and business processing and need a reliable AS2 edge. Choose a broader managed EDI service when you also want the provider to map documents, coordinate business tests or operate partner-specific business workflows.
Separate the price and responsibility of transport, translation and business support. This makes comparisons clearer and prevents gaps during incidents.
AS2Connection offers a managed cloud AS2 gateway with partner profiles, certificate operations, REST API, webhooks and visible message states.
