AS2 Protocol in EDI: What It Is and How It Works

AS2 is the protocol quietly carrying most of the world's EDI traffic, and if you've ever onboarded a Walmart supplier or set up a carrier connection for load tenders, you've almost certainly touched it. Yet the term gets confused constantly with EDI itself, with VANs, and now with its supposed successor AS4. Here's what AS2 actually is, how the encryption and receipt mechanism works, and where it fits specifically in freight and carrier connectivity.

What is AS2?

AS2 (Applicability Statement 2) is an internet transmission protocol that sends business documents, including EDI files, securely over HTTP or HTTPS. Applicability Statement 2 is a protocol for securely exchanging EDI documents over the internet, using encryption and digital signatures to protect data, and providing a Message Disposition Notification as a receipt confirming delivery. It is not a document format. AS2 doesn't care whether the payload inside is an X12 850, an EDIFACT ORDERS message, or a flat file. It's the delivery truck, not the cargo.

This distinction trips people up more than any other part of the AS2 conversation. EDI describes the structure of the data (purchase orders, invoices, ASNs). AS2 describes how that data physically gets from your server to your trading partner's server, with cryptographic proof it arrived intact. Confusing the two is a bit like confusing a shipping container with the highway it travels on.

How AS2 actually moves a document

The mechanics come down to four steps: sign, encrypt, transmit, receipt. When your system sends an AS2 message, the sender digitally signs the document using its private key, encrypting the previously calculated hash of the document with the sender's private key and attaching it as the signature, which establishes non-repudiation meaning the sender cannot deny sending the document.

After signing, the message gets encrypted. Once signed, the message is encrypted using the receiver's public certificate, and because AS2 uses asymmetric encryption, only the receiver's private key can decrypt the message. The most common algorithms in practice are Triple DES (3DES) and AES-256 for encryption, with SHA1, SHA256 and SHA512 used for signatures — though anyone setting up a new connection today should be pushing for AES-256 and SHA-256 as a minimum; 3DES and SHA-1 are legacy holdovers most security teams want retired.

The whole package then travels as an AS2 message sent as an HTTP(S) POST operation to the URL specified by the AS2 URL attribute. Once the receiving server decrypts and verifies the signature, it generates the piece that gives AS2 its reputation: the MDN. The Message Disposition Notification is a signed receipt sent to the sender as proof that the message has been received. That receipt is itself digitally signed, so you get cryptographic evidence the document arrived and wasn't altered in transit — not just a "trust me" acknowledgment.

AS2 vs VAN vs API: three different transport methods

A VAN is a store-and-forward mailbox model — you drop a file, the network holds it, your partner retrieves it later. AS2 is a direct, point-to-point internet connection between two systems, no mailbox in the middle. An API is a real-time, request/response call, not a batch document sitting in a queue.

The reason AS2 became the default for retail and logistics traces back to one company. In September 2002, Walmart announced its transition to the AS2 protocol for EDI exchanges, requiring all suppliers to adopt AS2 as well. This encouraged other retailers to follow suit including Amazon, Target, Lowe's, Bed Bath & Beyond, and thousands more. Today Walmart mandates EDIINT AS2 as the communication protocol for all suppliers processing more than 5,500 invoices per year, with smaller-volume suppliers routed to WebEDI or a VAN instead.

AS4 is often pitched as the AS2 replacement. AS4 is an open B2B standard for securing and exchanging documents using Web Services, designed as a simplified conformance standard of the ebMS v3.0 specification, with security achieved through WS-Security, XML Encryption, and XML Digital Signatures rather than AS2's S/MIME approach. It's gaining traction in e-invoicing and European Peppol/eDelivery mandates, but for day-to-day retail and logistics EDI, migration is slow. Most integration platforms now run both side by side rather than forcing a switch, since some platforms support both protocols in the same installation, which simplifies hybrid B2B environments where some partners use AS2 and others have migrated to AS4.

A worked example: shipper to carrier over AS2

Picture a manufacturer's TMS generating an EDI 204 (motor carrier load tender) for a truckload move. The TMS signs and encrypts the 204, then POSTs it via HTTPS to the carrier's AS2 URL. The carrier's gateway decrypts it, verifies the signature, and immediately fires back a signed MDN confirming receipt, before a human on either side has looked at anything. Minutes or hours later, the carrier's system responds with a 990 (accept or decline the tender), and once the load moves, a series of 214 status updates.

This is exactly the plumbing that platforms like Cargoson, alongside Descartes, MercuryGate, and Transporeon, exist to absorb. These systems connect to carriers and freight forwarders via API or EDI so a shipper isn't maintaining a separate AS2 certificate and firewall rule for every carrier in their network. When you're managing tenders across dozens of carriers, running individual AS2 endpoints per relationship becomes its own full-time job.

Certificates, firewalls, and what breaks

Setting up AS2 yourself means generating or buying a certificate pair, opening an inbound HTTP(S) port through your firewall, and agreeing with each partner on matching encryption and signature algorithms. Virtually no ERP system offers inbuilt AS2 capability, so it must be integrated separately, and this requires detailed knowledge that can lead to long troubleshooting if the administrator isn't well versed with AS2.

The failure points that actually show up in production:

• Expired or mismatched certificates — one side renews, forgets to notify the other, and messages start bouncing with decryption errors
• Algorithm mismatches — one partner upgrades to AES-256/SHA-256 while the other is still configured for 3DES/SHA-1
• MDN timeouts on asynchronous setups, where the receipt never comes back and the sender's system flags a false failure
• Firewall changes that silently close the inbound port after a network team's routine maintenance

This is precisely why many shippers outsource AS2 connectivity to a VAN, integration platform, or carrier-connectivity software instead of running a server per partner. On-premise AS2 still fits regulated, stable, high-volume workloads, while cloud AS2 wins on scale, certificate management, and trading partner onboarding speed.

When AS2 still makes sense

AS2 is the right call when a partner mandates it (Walmart-style relationships leave you no choice), when document volumes are high, or when you need a legally defensible, non-repudiable delivery record. It's less suited to smaller or less technical partners who can't maintain their own certificates — a VAN is often the more forgiving fallback there. And it's the wrong tool if you need real-time visibility rather than batch document exchange; that's what APIs are for. Most mature logistics operations run AS2 for legacy, high-volume, compliance-driven lanes and API or webhook connections for newer carriers side by side, rather than picking one transport method for the whole network.

FAQ

Is AS2 the same as EDI? No. EDI is the document standard (X12, EDIFACT). AS2 is the transport method that carries those documents securely over the internet.

Do I still need a VAN if I use AS2? Not in principle — AS2 facilitates point-to-point communication, reducing the need to outsource to managed services, much like directly dialing long distance instead of going through a phone company operator. In practice, many companies keep a VAN for partners who aren't AS2-capable.

What is an MDN and why does it matter? It's the signed receipt AS2 generates on delivery, giving both parties cryptographic proof the document arrived and wasn't tampered with in transit.

Is AS2 secure enough for regulated data? Yes — its compliance with HIPAA makes AS2 particularly popular in healthcare, and the same encryption and signature stack applies to any regulated exchange.

Will AS4 replace AS2? Not soon. AS4 is gaining ground in Europe and in e-invoicing mandates, but AS2's installed base across retail and logistics is too large to displace quickly. Expect both to coexist for years.