AS2
Riversoft® STCP DirectLink exchanges documents with partners over AS2 (Applicability Statement 2), the B2B standard for exchange over HTTP/HTTPS with digital signature, encryption and delivery confirmation (MDN). Each side of the exchange has a role:
| Component | Who starts the connection | Function |
|---|---|---|
| AS2 connector | Riversoft STCP DirectLink (outbound connection) | Sends documents to the partner’s AS2 server and receives the synchronous MDN. |
| AS2 DirectLink service | The partner (inbound connection) | Receives the documents the partner sends, replies with the MDN and receives the asynchronous MDNs of the documents sent by the connector. |
In AS2, each connection carries documents in a single direction. For the partner to send documents too, they connect to the AS2 DirectLink service.
Outbound connections (AS2 connector)
flowchart LR
subgraph DL[Riversoft STCP DirectLink]
SA["saida directory"]
C[AS2 connector]
end
SA --> C
C -->|document| P[Partner AS2 server]
P -.->|synchronous MDN| C
Riversoft STCP DirectLink sends the partner the documents available in the user’s mailbox (saida directory), by schedule or when the operator starts the connection in the Riversoft Console Portal.
| Feature | Behavior |
|---|---|
| Document | Can be signed, encrypted and compressed, as agreed with the partner. |
| MDN | Delivery confirmation requested from the partner: synchronous (in the response of the connection itself) or asynchronous (sent later to the AS2 DirectLink service). The MDN can be signed and encrypted. |
| Authentication | None, Basic or Bearer, as required by the partner’s server. |
| TLS | Server certificate validation, custom CA and client certificate (mTLS). |
| Network | The connection can go through a proxy and through a specific local address. |
The AS2 connector only sends documents: it does not list or fetch files at the partner.
Inbound connections (AS2 DirectLink service)
flowchart LR
subgraph DL[Riversoft STCP DirectLink]
S[AS2 DirectLink service]
EN["entrada directory"]
end
Q[Partner AS2 client] -->|document / asynchronous MDN| S
S --> EN
S -.->|MDN| Q
The partner sends documents to the AS2 DirectLink service address. Each document is validated, written to the entrada directory of the user’s mailbox and answered with the MDN, as requested by the partner. The same service receives the asynchronous MDNs of the documents Riversoft STCP DirectLink sent.
| Authentication | Validation |
|---|---|
| None | No HTTP credential. Use only when the exchange is protected by signature and mTLS. |
| Basic | Riversoft STCP DirectLink user and password. |
| Bearer | Only an impersonation token registered for the user. |
Besides the credential, the message recipient (AS2-To) must match the AS2 identification registered for the user.
The AS2 DirectLink service is registered in the instance network services, in the Riversoft Console Portal: address, port, TLS and the public service address.
What to agree with the partner
| Item | Description |
|---|---|
| AS2 identifications | Riversoft STCP DirectLink AS2 ID and the partner’s AS2 ID. |
| Addresses | Partner AS2 server URL and public AS2 DirectLink service URL, also for asynchronous MDNs. |
| Certificates | Exchange of signing and encryption certificates on both sides, and the algorithms used. |
| Document options | Signed, encrypted and compressed, on sending and receiving. |
| MDN | Synchronous or asynchronous, signed or not. |
| HTTP authentication | Basic or Bearer, when required. |
These details are registered in the user, in the Riversoft Console Portal.
Security
- Sign and encrypt the documents and request a signed MDN: this gives the exchange proof of delivery and non-repudiation.
- Publish the AS2 DirectLink service over HTTPS only and, whenever possible, require mTLS from the partner.
- Renew the certificates before they expire and agree on the exchange with the partner in advance.
- See the supported algorithms in Security: AS2.