Your tests grade mostly C. That is a signal, not a verdict.
Repeated C grades usually trace to a small set of configuration issues that are fixable once pinpointed. This audit finds them, explains them, and prioritizes the fixes by how much they change your grades.
One-time $299. No subscription, no auto-renewal. 1 business day from receipt of what we need.
A 1-business-day SLA. Your gateway vendor's support ticket may still be open.
What we review
We review your AS2 configuration and test history against the same checks your AS2Certify tests execute, and map every non-passing grade back to its root cause.
| Check (product weight) | What we review |
|---|---|
| TCP/TLS Connection (25%) | Firewall rules, DNS, TLS version and negotiation with your partners. |
| AS2 Message Exchange (20%) | Protocol negotiation, partner config alignment, message routing. |
| Certificate Validation (15%) | Expiry, chain completeness, key size, renewal gaps. |
| Encryption Verification (10%) | Cipher-suite alignment, AES-256 vs 3DES mismatches. |
| Signing Verification (10%) | Signing enabled, SHA-256 digest, signed MDN requirements. |
| MDN Receipt Validation (10%) | Sync vs async MDN mode, disposition and MIC handling. |
| Payload Integrity (5%) | Encoding, compression, checksum mismatches. |
| Latency Measurement (5%) | Network path, region placement, load. |
Weights match the product's grading, so the fix list is ordered by actual impact on your grade.
What you receive
A written findings list
Every issue, the check it maps to, and the test evidence behind it.
Prioritized fixes
Ordered by impact, weighted to match the grading above.
A 30-minute walkthrough
Review the findings with us and ask follow-up questions.
Yours to act on
Keep the report and apply fixes through AS2Certify or a vendor.
What this is not
- Not a managed service. We identify what is wrong; you or your vendor apply the fixes.
- Not ongoing monitoring. Recurring retesting stays on your plan.
- Not a certification, and no grade guarantee. This is not Drummond or any other certification body.
- No private keys, ever. We never request or handle customer private keys. The public certificate is extracted in your browser; only the public cert reaches us.
Stop re-running the same failing test.
One audit, one prioritized fix list, one call. Apply the fixes yourself or hand the list to your vendor.
Already passing and want to keep it that way? See plans for ongoing testing.