Background
AS2 (Applicability Statement 2) is used to exchange EDI messages (UN/EDIFACT or ANSI X12) between the carrier and SAP Business Network for Freight Collaboration (BN4L) over HTTP(S), using X.509 certificates for message-level signing and encryption. In the System Connections (Carrier) app, AS2 supports two directions:
- Outbound — BN4L sends EDI messages to the carrier's AS2 endpoint. The configuration defines where to send (the carrier-side AS2 URL and AS2 IDs) and which certificate secures the payload.
- Inbound — the carrier's system pushes EDI messages into BN4L over AS2. This is configured as a Receive AS2 service connection. BN4L's AS2 endpoint and SAP Cloud Integration certificate are then made available to the carrier-side AS2 tool.
Unlike SFTP or HTTPS, AS2 authentication is certificate-based rather than username/password. The security profile — signing/encryption algorithms, MDN, and compression — is managed internally by the system and is not exposed as configuration.
Prerequisites
The following are needed before configuration begins:
Item Used for Source
| Carrier-side AS2 endpoint URL | Outbound | The carrier's AS2 tool |
| Carrier-side AS2 ID | Both | The carrier's AS2 tool |
| SAP AS2 ID | Both | The identifier that represents SAP/BN4L in the carrier's AS2 tool |
Public certificate (.pem / .cer / .crt) | Both | The carrier's AS2 tool |
| AS2 message format & type (e.g. UN/EDIFACT · IFTMIN, or ANSI X12 · 204) | Outbound | Agreed for the connection |
| BN4L outbound IPs allowlisted | Outbound | Connection Settings → Outbound |
The AS2 building blocks
Three artifacts combine to make an AS2 connection:
- AS2 Communication Detail — the “where and how to send” record (AS2 URL, AS2 IDs, message format/type, file name). Created under Manage Details → Communication Details.
- AS2 Certificate — the carrier's public certificate, created under Manage Details → Authentication Details. It secures both directions (inbound and outbound). Uploading it automatically provisions a dedicated service instance in the background.
- Service connection — binds a communication detail (and, for AS2, a certificate) to a service + operation. Created from the Outbound Connections page (Create).
One AS2 certificate per tenant. The system allows exactly one AS2 Certificate per tenant, and that single certificate serves both inbound and outbound. Attempting to add a second returns an “AS2 certificate already exists” error — the existing one is replaced instead (see Certificate lifecycle).
Dedicated service instance (auto-provisioned). When the AS2 Certificate is added, the system asynchronously creates a service instance and generates the client credentials used to authenticate inbound AS2 calls. Provisioning takes a short while; progress and credentials are available from the certificate's Service Credentials dialog (see Certificate lifecycle).
Configuration paths
AS2 can be configured two ways:
- Manage Details (manual) — each artifact is created individually, then bound to a service. This guide uses the manual path as its main walkthrough because it makes each configuration item explicit.
- Connection Wizard (guided) — a single guided dialog that creates the artifacts and binds them in one pass. See Using the Connection Wizard.
Both paths produce the same artifacts.
Part A — Add the AS2 Certificate (both directions)
The AS2 Certificate is shared by inbound and outbound, so it is added first.
- Navigate to Manage Details → Authentication Details.
- Click Add → AS2 Certificate. The Add AS2 Certificate dialog opens.
- Enter a Name (unique).
- For Certificate File, upload the public certificate (
.pem,.cer, or.crt). - Click Add.
The certificate appears in the Authentication (Security Artifacts) table, showing Name, Type, Valid Until (color-coded by validity — green/amber/red), Subject DN, and Issuer DN. Provisioning status is shown in the Service Credentials dialog (next).
Part B — Outbound AS2
Use case: BN4L sends EDI messages to the carrier's AS2 endpoint (e.g. Post freight order for subcontracting).
Step B1 — Confirm outbound IPs are allowlisted
Under Connection Settings → Outbound, confirm the BN4L outbound IP addresses are allowlisted on the carrier side and that outbound connections are enabled. Without this, outbound delivery fails.
Step B2 — Add the AS2 Communication Detail
- Navigate to Manage Details → Communication Details.
- Click Add → AS2 (EDI). The Add AS2 Communication Detail dialog opens.
- Complete the form
- Click Add.
| Field (UI label) | Required | Notes |
| Name | Yes | Unique label, e.g. Carrier_AS2_Out. |
| Partner AS2 URL | Yes | The carrier-side AS2 endpoint BN4L sends messages to. |
| SAP AS2 ID | Yes | The AS2 identifier that represents SAP in the carrier's AS2 tool. |
| Partner AS2 ID | Yes | The AS2 identifier that represents the carrier's organization in the carrier's AS2 tool. |
| Message Format | Yes | UN/EDIFACT or ANSI X12. |
| Message Type | Yes | Depends on format — e.g. EDIFACT: IFTMIN / IFTSTA; X12: 204 / 210 / 214. |
| Message Version | — (read-only) | Auto-filled from the message type; hidden for All Inbound Messages. |
| Description | — (read-only) | Auto-filled from the message type; hidden for All Inbound Messages. |
| File Name | Yes | Output file name; supports tokens such as %timestamp% — e.g. IFTMIN_%timestamp%.edi. |
On the “Partner” related labels. In the UI, Partner AS2 URL and Partner AS2 ID refer to the carrier-side AS2 tool — the counterpart of SAP/BN4L in the exchange. SAP AS2 ID is the identifier that represents SAP. The two IDs must match what is configured on the carrier-side AS2 tool so both sides interoperate.
Security is not configured here. Signing/encryption algorithms, MDN, and compression are managed internally — there are no fields for them.
Part C — Inbound AS2 (Receive AS2)
Use case: the carrier's system pushes ANSI X12 or EDIFACT messages into BN4L over AS2. There is no pull schedule — messages are pushed to BN4L's AS2 endpoint, which is different from SFTP.
Inbound AS2 is configured as a Receive AS2 service connection.
Step C1 — Ensure the AS2 Certificate exists
Inbound verification uses the same AS2 Certificate as outbound. If it has not been added yet, complete Part A first.
Step C2 — Create the Receive AS2 service connection
- On the Outbound Connections page, click Create.
- Service: select
EDI Inbound All(fixed for inbound EDI). - Operation: select Receive AS2.
- Message Format: EDI.
- Communication Details / Authentication Details: select the AS2 communication detail for inbound usage and the AS2 Certificate.
- Status: Active, then Create.
Once active, the carrier-side AS2 tool can push AS2 messages to BN4L's AS2 endpoint; BN4L verifies them with the AS2 Certificate and ingests the EDI payload.
Configuring the carrier-side AS2 tool
For inbound to work, two artifacts produced by BN4L are configured on the carrier-side AS2 tool.
The SAP Cloud Integration certificate
- On the Outbound Connections page, open Connection Settings.
- In the AS2 section, click Download SAP Cloud Integration Certificate.
- Import it into the carrier-side AS2 tool. Per the in-app note: “Partner uses this to encrypt messages to SAP Cloud Integration and verify its signatures.”
The AS2 Endpoint URL
- Navigate to Manage Details → Authentication Details.
- On the AS2 Certificate row, click the key icon (Show Service Credentials). The AS2 Certificate Service Credentials dialog opens.
- When provisioning is complete (status Success), the dialog shows AS2 Endpoint, Client ID, and Client Secret, each with a copy button.
- Configure the AS2 Endpoint URL as the target in the carrier-side AS2 tool. The Client ID / Client Secret are used where that endpoint requires authentication.
Certificate lifecycle
The Service Credentials dialog (key icon on the AS2 Certificate row) shows provisioning status:
State What is shown Action
| In Progress | Warning strip: “The certificate is being uploaded to SAP Cloud Integration. Client credentials will be available shortly. Check back in a moment.” + Refresh | Wait, then Refresh. |
| Success | AS2 Endpoint, Client ID, Client Secret (each copyable) | Configure the endpoint/credentials on the carrier-side AS2 tool. |
| Error | Error strip: “Certificate provisioning failed. Delete this certificate and create a new one.” | Delete and re-create the certificate. |
Replace — the Replace action on the certificate (Edit AS2 Certificate → Replace) uploads a new file. The warning reads: “AS2 certificate file already saved. Uploading a new file replaces the existing one.” Because there is one certificate per tenant, replacing updates both inbound and outbound at once. It should be replaced before the current certificate expires.
Delete — removes the certificate and tears down the provisioned service instance and its credentials. Inbound verification and outbound encryption stop working immediately, so this is done only when decommissioning AS2.
Using the Connection Wizard
The Connection Wizard blog walks through the full 5-step wizard flow (Direction → Type → Service → Communication → Authentication). For AS2, make the following selections:
Outbound AS2 (Direction = Outbound, Type = EDI
- Step 4 (Communication): on the Create New tab, select the AS2 tile (“Send and receive EDI documents using the AS2 protocol”). The form is the same AS2 fields from Step B2.
- Step 5 (Authentication): select the AS2 Certificate tile (“Partner's public certificate for AS2”), then provide Name + Certificate File.
Inbound AS2 (Direction = Inbound, Type = EDI
- Step 3 (Service & Operation): Service = EDI Inbound All, Operation = Receive AS2. With Receive AS2 selected, there is no recurrence/pull schedule to configure.
- Step 4 (Communication): select the AS2 tile.
- Step 5 (Authentication): select the AS2 Certificate tile.
The final step offers Save and Activate (activate immediately) or Save (activate later from the Outbound Connections list).
Summary
| Task | Where |
| Add the AS2 certificate (both directions) | Manage Details → Authentication Details → Add → AS2 Certificate |
| Get inbound endpoint & credentials | Authentication Details → AS2 row → key icon (Service Credentials) |
| Download the SAP CI certificate | Connection Settings → AS2 → Download SAP Cloud Integration Certificate |
| Define the outbound target | Manage Details → Communication Details → Add → AS2 (EDI) |
| Bind outbound to a service | Outbound Connections → Create → Message Format = AS2 |
| Set up inbound | Outbound Connections → Create → Service = EDI Inbound All, Operation = Receive AS2 |
| Guided alternative | Outbound Connections → Connection Wizard (see above) |
A single AS2 Certificate underpins both directions, and the security profile is managed by the system — so most of the effort is aligning the endpoint/certificate/IDs between this app and the carrier-side AS2 tool, and defining the outbound target and inbound Receive AS2 connection.
Source link
