AS2 (Applicability Statement 2)
AS2 (Applicability Statement 2) is a secure internet protocol for sending EDI and other business documents directly between trading partners. It wraps the payload in encryption and a digital signature and returns a signed receipt called an MDN. AS2 is the most common direct connection method in retail EDI, avoiding per-document VAN fees.
How AS2 works
AS2 sends documents over HTTPS, encrypted and digitally signed using S/MIME. The receiver returns a signed MDN, a Message Disposition Notification, which proves the file arrived intact and was read. Partners exchange certificates and AS2 IDs once, then transmit files directly with no intermediary.
AS2 versus a VAN
AS2 is direct, real-time, and has no per-document fee, but you run the AS2 software and manage certificate renewals. A VAN is simpler to operate but bills by volume. Large partners like Walmart and Amazon support AS2, which is why high-volume suppliers favor it.
What ports does AS2 use?
AS2 runs over HTTP and HTTPS, so it uses port 80 or 443 by default. Nothing in the specification mandates those ports, and many partners listen on a non-standard port such as 4080 or 5443 to keep AS2 traffic separate from web traffic. The listening port is whatever your partner publishes in their connection profile, so take it from their setup sheet rather than assuming 443. Your firewall needs an outbound rule to their host and port, and an inbound rule to yours if you receive asynchronous MDNs.
Does AS2 use FTP?
No. AS2 runs over HTTP and HTTPS and has nothing to do with FTP. SFTP and FTPS are separate, alternative transports for moving EDI files, and a trading partner will typically offer one or the other rather than both. The confusion is common because all three are ways of getting an EDI file from A to B, but AS2 is the only one of the three that carries its own encryption, digital signature, and signed receipt inside the message itself.
AS2 start to end: the full handshake
One AS2 transfer runs through six steps. First, the partners exchange public certificates and AS2 identifiers, once, at onboarding. Second, the sender assembles the payload, usually an X12 or EDIFACT file. Third, the payload is signed with the sender's private key and encrypted with the receiver's public key using S/MIME. Fourth, the message is POSTed over HTTPS to the partner's AS2 URL. Fifth, the receiver decrypts with their private key and verifies the signature against the sender's certificate. Sixth, the receiver returns a signed MDN confirming the message arrived intact. A synchronous MDN comes back on the same HTTP connection; an asynchronous MDN arrives later as a separate inbound POST, which is why receiving partners need an inbound listener too.
AS2 vs SFTP vs VAN vs API
AS2 is direct, carries its own encryption and signed receipt, and has no per-document fee, but you run the software and manage certificates. SFTP is simpler and widely supported but has no built-in non-repudiation, so proof of delivery depends on logs rather than a signed receipt. A VAN needs almost no operational effort and gives you one connection to reach many partners, but bills per document or per kilocharacter. A REST API is the easiest to build against and gives immediate responses, but very few large retailers offer one for EDI. Most real programs run a mix, because the choice is usually made by the partner rather than by you.
AS2 certificate expiry and renewal
Certificates are the most common cause of an AS2 connection that worked for two years and then stopped overnight. They typically last one to three years, and when one expires transmissions fail immediately with a signature or decryption error at the partner end. Renewal has to be coordinated: both sides import the new certificate before the old one lapses, and most partners want two to four weeks of notice. Track expiry dates for every partner and alert at 60 days. Overlapping the old and new certificate for a short window avoids a hard cutover.
Related Terms
Related Resources
Frequently Asked Questions
AS2 is used to transmit EDI and other business documents securely and directly between two trading partners over the internet, without a value-added network in between.
An MDN, or Message Disposition Notification, is the signed receipt the receiver sends back in AS2. It confirms the message was delivered and not altered, providing non-repudiation.
It can. AS2 connects you directly to a trading partner with no intermediary and no per-document fee, which is exactly what a VAN charges for. The catch is that AS2 is point to point: you need a separate connection to every partner, and each one means certificates to manage. A VAN gives you one connection that reaches many partners. Companies with a few high-volume partners usually move those to AS2 and keep a VAN for the long tail.
Whatever port your trading partner publishes. The defaults are 80 for HTTP and 443 for HTTPS, but non-standard ports such as 4080 and 5443 are common because they keep AS2 traffic off the public web server. Always take the port from the partner's connection profile.
Yes. TrueCommerce supports AS2 connections, as do the other major EDI platforms. You exchange AS2 identifiers, URLs, and public certificates with them once, then transmit directly. The setup work is the same as with any AS2 partner: agree the IDs, import certificates on both sides, confirm whether MDNs are synchronous or asynchronous, and run a test transmission before going live.
AS2 is its own method and it runs over HTTP and HTTPS. It does not use FTP, SFTP, or FTPS. Those are separate transports that a partner may offer instead of AS2, not underneath it.
Automate every order format
OrderSync processes EDI, PDF, email, and fax orders into your ERP with AI extraction and validation. No VAN middleware.