AS2 Compliance Testing
Validate your AS2 connection against RFC 4130. AS2 Certify sends a real signed and encrypted test message, verifies the MDN receipt, and returns a graded A to F report covering TLS, certificates, encryption, signing, and latency in minutes.
Why AS2 compliance is not optional
AS2 is the transport most large retailers and regulated industries mandate for secure EDI document exchange. Walmart, Amazon, Target, and Kroger all require a working AS2 connection as a condition of trading-partner onboarding. In pharma, the U.S. Drug Supply Chain Security Act requires serialized transaction data between partners, and AS2 carries most of that traffic. (See the DSCSA AS2 setup guide.)
The traditional way to validate an AS2 connection is manual: schedule a test window with the partner, exchange certificates over email, send handcrafted test messages, and read raw MDN disposition strings to figure out what failed. It takes days, burns engineer-hours, and produces no auditable artifact. A single failed onboarding can consume weeks of back-and-forth.
AS2 compliance testing replaces that with a repeatable, instrumented round trip. You get a graded report that names exactly which requirements the connection satisfies and which it fails, with the remediation for each failing check.
What AS2 compliance testing checks
Six compliance dimensions, derived from RFC 4130 and the MDN specification, cover the failure points that block onboarding. Each check reports the exact value it observed, not just pass or fail.
TLS handshake
The endpoint accepts a TCP connection and negotiates a modern TLS handshake (TLS 1.2 or 1.3) with an acceptable cipher suite. Deprecated protocols like TLS 1.0 are flagged.
Certificate validity
The partner certificate is checked for expiration, key strength (2048-bit RSA or stronger), and a trusted CA chain. A missing intermediate fails partner validation even when the leaf cert is valid.
S/MIME encryption
The payload is encrypted with an algorithm the partner accepts. The report names the negotiated cipher and flags legacy options: 3DES is still seen in the wild, while AES-128 and AES-256 are the modern expectation.
Digital signatures
The signed MDN is verified for a valid S/MIME (PKCS#7) signature. SHA-1 and MD5 digests are deprecated and flagged as failures; SHA-256 or stronger is required by current retailer and pharma specs.
MDN receipts
The endpoint returns a Message Disposition Notification confirming the test message was received and processed. Both synchronous (same HTTP response) and asynchronous (separate callback) MDN modes are exercised.
Round-trip latency
The full round trip is timed. Two seconds or less is excellent, up to five is acceptable, and anything slower is flagged. Latency rarely fails a compliance gate but predicts production reliability.
These six are part of the full 8-step AS2 testing methodology, which adds payload integrity and weighted latency scoring. For a deeper comparison of the transport options, see AS2 vs SFTP.
How the A-F compliance grade works
Each of the eight diagnostic steps carries a weight that sums to 100. A pass earns the full weight, a warn earns 60%, and a fail earns zero. Criticality overrides apply on top so a high score cannot hide a broken connection: if both critical steps (the connection and the message exchange) fail, the test is graded F regardless of the raw score.
Production ready
Score 95+, zero failed steps, no high or critical warnings. Ready to onboard with any partner.
Minor warnings
Score 80+, no critical-step failures. Typical of a certificate nearing renewal or a non-blocking latency warning.
At least one issue
Score 60+, at most one critical-step failure. Fixable, but not safe to onboard against yet.
Multiple failures
Score 40+. Several steps failed; the connection needs reconfiguration before retest.
F
Below 40, or both critical steps (connection and message exchange) failed. The connection does not work.
Free
$03 tests per month, full 8-step diagnostic, partner simulator sandbox.
Pro
$99/moUnlimited tests, detailed fix-guidance reports, AI assistant, 30-day history.
Enterprise
$599/moREST API, DSCSA compliance module, PDF reports, priority queue, dedicated SLA.
The 8-step diagnostic runs on every plan, including Free. See the full methodology for the weights and grading algorithm, or pricing for the complete plan comparison.
What a compliance report looks like
An illustrative example, not a real customer's data. It shows what a passing-but-imperfect AS2 compliance result looks like once the diagnostic has run.
GRADE B
Sample report · score 92/100Pass: TLS handshake
TLS 1.3 negotiated with AES-256-GCM cipher suite.
Warning: Certificate validity
Signing certificate expires in 18 days. Renew before it lapses.
Pass: S/MIME encryption
Cipher suite supports AES-256.
Pass: Digital signatures
Signed MDN verified: PKCS#7 signature with SHA-256 digest.
Pass: MDN receipt
Signed MDN received and processed.
Warning: Round-trip latency
3.8s round trip. Acceptable, but slower than the 2s target.
A passing compliance report is also the artifact behind the AS2 Verified badge: a connection that earns A or B qualifies to display it. See the full methodology and grading scale.
Who needs AS2 compliance testing
Retail vendors
Walmart, Amazon, Target, Kroger, and other large retailers mandate AS2 for EDI document exchange. Their onboarding specs require specific ciphers, signing algorithms, and a working MDN round trip before they will trade.
Walmart AS2 setup guidePharmaceutical (DSCSA)
The Drug Supply Chain Security Act requires serialized transaction data exchange between trading partners. AS2 is the transport most wholesalers and manufacturers use to meet the DSCSA electronic interoperability requirement.
DSCSA AS2 compliance setupHealthcare (HIPAA)
Covered entities and business associates exchanging PHI over AS2 rely on its S/MIME encryption and signing envelope to satisfy HIPAA Security Rule transmission-protection requirements.
Any B2B EDI partner
If your trading partner publishes an AS2 connection spec, you need to prove you meet it before going live. AS2 compliance testing produces the artifact that proves it.
Frequently asked questions
What is AS2 compliance testing?
AS2 compliance testing verifies that an AS2 connection meets the requirements of RFC 4130, the standard that defines AS2 (Applicability Statement 2) for secure EDI document exchange over HTTPS. A compliance test exercises the real connection end to end: TLS handshake, certificate validity, S/MIME payload encryption, message signing, and the Message Disposition Notification receipt. The output is a graded report showing exactly which requirements the connection meets and which it fails.
How do I test AS2 compliance?
Enter your partner's AS2 endpoint URL into the AS2 Certify test tool. The free public check runs DNS, TCP, TLS, certificate, and HTTP checks live with no signup. A free account then runs the full 8-step diagnostic: it sends a real signed and encrypted AS2 message to your endpoint, waits for the signed MDN, verifies the signature against the partner certificate, and returns a graded A to F report with the exact value each check observed.
Is AS2 compliance required?
It depends on who you trade with. Walmart, Amazon, Target, Kroger, and other major retailers require a working AS2 connection as a condition of EDI onboarding. Pharmaceutical manufacturers, wholesalers, and dispensers must exchange serialized transaction data under the U.S. Drug Supply Chain Security Act (DSCSA), and AS2 is the most common transport for that. Healthcare organizations rely on the AS2 S/MIME envelope to satisfy HIPAA transmission-security requirements. In each case the partner or regulator requires evidence that the connection works; a graded compliance report is that evidence.
How long does AS2 compliance testing take?
About 60 seconds for a responsive endpoint. The full run, including the signed MDN round trip, finishes in minutes even when the partner server is slow. The free public check is synchronous; the full diagnostic runs asynchronously and the report is ready by the time you finish reading the methodology.
What is the difference between AS2 compliance testing and Drummond certification?
Drummond Group certifies that an AS2 software implementation conforms to the RFC once, through a paid, lab-based conformance program. AS2 compliance testing here is continuous: it validates a specific, live partner connection each time it runs. The two answer different questions. Drummond answers is this software RFC-conformant. A compliance test answers does this connection meet my partner's spec today.
Test your AS2 connection now
Run the free public check with no signup, or create a free account to run the full 8-step diagnostic and unlock the graded compliance report.