AS2 transport / exact-byte evidence
Send EDI over AS2 without mistaking HTTP success for delivery proof
Bind a release to exact validated bytes, sign and encrypt it, request a signed receipt and preserve the MIC evidence operators need.
Direct answer
Direct answer
AS2 EDI software should package the released payload as S/MIME, identify both parties with AS2-From and AS2-To, request a signed Message Disposition Notification and compare the receipt MIC with the digest of the sent content. Shipment Sentry uses SHA-256 signatures, optional AES-256-CBC encryption, deterministic message identity, bounded retries and a fail-closed MDN/MIC check. Route health shows SHA-256 fingerprints, validity status and expiry for signing, MDN-verification and encryption certificates; a daily monitor alerts before expiry, and expired or invalid required certificates block go-live readiness. HTTP 200 alone is not recorded as AS2 delivery.
Why a parser is not enough
AS2 has multiple independent evidence layers: the HTTPS exchange, the S/MIME signature, optional encryption, the disposition value and the received-content MIC. Flattening them into a green transport status makes changed bytes, a rejected disposition or a mismatched receipt hard to detect.
What the control should check
- 01Require a public HTTPS endpoint and reject private or loopback destinations.
- 02Verify that the configured signing certificate and private key match.
- 03Inspect each certificate’s SHA-256 fingerprint, current validity and expiry before go-live.
- 04Run the daily expiry monitor and rotate credentials before the configured alert window closes.
- 05Set AS2-From, AS2-To, AS2-Version, Message-ID and Content-Type on the exact packaged entity.
- 06Request a signed receipt using SHA-256.
- 07Require a processed disposition and compare the returned MIC in constant time.
- 08Keep every attempt, response, latency, receipt and content hash in the dispatch ledger.
Working example
AS2-From: SHIPMENT_SENTRY
AS2-To: RETAILER_AS2
Message-ID: <release-key@shipmentsentry>
Disposition-Notification-Options: signed-receipt-micalg=required,sha-256
MDN: processed / sha-256 MIC matchedThe matched MDN proves the AS2 receipt outcome for the packaged content. It is not a 997, 999, 824 or other business acknowledgement.
Failure modes worth catching
- The endpoint returns 200 but no processed MDN.
- A certificate is readable but does not match the configured private key.
- A signing or MDN-verification certificate is expired, not yet valid or close to expiry without a rotation plan.
- A retry silently regenerates different business bytes.
- A receipt MIC names a different digest algorithm or does not match the sent entity.
Put it into the dispatch workflow
- 1Validate and clear the partner output.
- 2Confirm required certificate fingerprints, validity and expiry.
- 3Stage immutable bytes under a stable release key.
- 4Build the signed and optionally encrypted AS2 entity.
- 5POST it with the configured AS2 identities and receipt request.
- 6Verify the MDN disposition and SHA-256 MIC.
- 7Record delivery separately from later functional or application acknowledgement.
Questions
Implementation answers
Does Shipment Sentry support signed AS2 MDNs?
Yes. The route requests a signed receipt and requires a processed disposition plus a matching SHA-256 MIC before it records delivery.
Can AS2 payloads be encrypted?
Yes. Add the partner encryption certificate to encrypt the signed entity with AES-256-CBC.
How does AS2 certificate rotation monitoring work?
Route health displays SHA-256 fingerprints, validity and expiry for each configured certificate. A daily check raises expiry alerts, while expired or invalid required certificates block go-live readiness until they are rotated.
Does an AS2 receipt mean the EDI was accepted?
No. An MDN is transport evidence. Functional and application acknowledgements remain separate states.
Sources and limits
Reviewed 2026-07-21. Public references cannot establish every partner-specific rule. Current implementation guides and agreements remain controlling.
Keep investigating