Once you have gathered the required setup information, you can configure your Stedi AS2 connection.

​
Choose your AS2 identifier

The AS2 protocol requires that the sender and receiver provide each other with AS2 IDs to help identify and route transactions during the AS2 file exchange process. Your partner will provide their AS2 ID during the onboarding process. There is no central authority that registers or tracks AS2 IDs, so you can choose any value you like. You should choose a value that is unlikely to be used by other companies. It’s common to use the same value that you chose for your ISA ID when you created your Local profile. An AS2 ID must be between 1-128 printable ASCII characters (except double quote or backslash), and is case sensitive. It’s customary to use all capitalized letters and include no spaces.

​
Create an AS2 connection

Creating an AS2 connection provisions all the resources required to send and receive data using the AS2 protocol. You can only create one AS2 connection per partnership. To create an AS2 connection:
  1. Go to the Trading partners page.
  2. Click the partnership where you want to add the connection.
  3. Click Create connection.
  4. Select AS2 as the Connection type.
  5. Stedi generates an internal Connection name. This is never visible to your trading partner and is used for unique identification with your Stedi account only. You can specify a custom name if desired. You cannot edit the name after the connection has been created.
  6. Leave ISA validation options as Default unless you’re very sure you need a different setting for your use case.
  7. Enter your AS2 ID as the Local AS2 profile identifier.
  8. (Optional) Under Local profile signing credentials you can upload the three different certificates required:
    • Certificate: Your public signing certificate
    • Private Key: Your private signing key
    • Certificate chain: Only required if you are using certificates and keys generated by a trusted certificate authority (CA)
  9. (Optional) By default, your Local profile encryption credentials use the same data you supplied for your local signing credentials. If you are using different certificate and key for encryption, toggle Same as signing credentials to OFF and supply: -Certificate: Your public encryption certificate
    • Private Key: Your private encryption key
    • Certificate chain: Only required if you are using certificates and keys generated by a trusted certificate authority (CA)
  10. Enter your trading partner’s AS2 ID as the Partner AS2 profile identifier.
  11. (Optional) Under Partner profile signing credentials, you can upload the two different certificates:
    • Certificate: Your trading partners’ signing certificate
    • Certificate chain: Only required when your trading partners are using certificates and keys generated by a trusted certificate authority (CA).
  12. (Optional) By default, the Partner profile encryption credentials use the same data you supplied for your partner signing credentials. If your trading partner is using a different certificate and key for encryption, toggle Same as signing credentials to OFF and supply:
    • Certificate: Your trading partner’s public encryption certificate
    • Certificate chain: Only required when your trading partner is using certificates and keys generated by a trusted certificate authority (CA)
  13. (Optional) If you plan to send data to your trading partner, set the Enable AS2 outbound to ON and enter the Partner AS2 server URL, the MDN response, and Encryption algorithm.
    • (Optional) If your trading partner requires Basic authentication, click Advanced > Enable basic access authentication, and enter the Username and Password.
  14. (Optional) If you plan to receive data from your trading partner, set the Enable AS2 inbound to ON and enter the Encryption algorithm. Note that if this is the first time you are enabling inbound AS2, you must click Enable inbound AS2 and wait for the server to be provisioned before you can finish creating the connection. This process provisions a unique server URL for you to share with your partners.
  15. Click Create connection. You must have enabled one or both of the Inbound or Outbound sections, before you can create the connection.

​
Certificates and keys

Before you configure your AS2 connection, you need to prepare the certificates that you will use. This involves generating your own certificates as well as requesting certificates from your trading partner. A certificate consists of both a public key and a private key. In AS2, there are two types of certificates:
  • Signing certificate: This certificate allows you and your partners to verify the message sender’s identity.
  • Encryption certificate: This certificate allows you and your trading partners to encrypt and decrypt messages.
Some partners require two certificates – one for signing and one for encryption. Others may want you to use the same certificate for both tasks. For example, Walmart’s AS2 portal only asks you to upload a single certificate. Follow the instructions from your trading partner when defining your AS2 configuration. If either you or your partner are using a certificate issued by a third-party Certificate Authority (CA), you can skip the certificate creation steps and use the provided certificate and key directly.
If you are sending files to a trading partner’s HTTPS endpoint, you must use an SSL certificate signed by a publicly-trusted certificate authority (CA). Self-signed certificates for HTTPS are not currently supported.
Certificates with the following cryptographic algorithms and key sizes are supported:
  • 2048-bit RSA
  • 4096-bit RSA

​
Convert certificates and keys between formats

The format in which the encryption materials are provided to you by your trading partner may be different than the PEM format that Stedi AS2 requires. You can use OpenSSL utilities to convert certificates and keys between different formats. Convert CRT to PEM: openssl x509 -in cert.crt -out cert.pem Convert CER to PEM: openssl x509 -in cert.cer -out cert.pem Convert DER to PEM: openssl x509 -in cert.der -out cert.pem

​
Create your signing and encryption certificates

If your trading partner requires unique certificates for signing and encryption, run the command twice. For each run, change the key names to indicate whether they are for signing or encryption. For example, use acme-signing-private.pem for the first run and acme-encryption-private.pem for the second run. Create a new certificate. The -days option specifies the number of days the certificate will remain valid. 
openssl req -x509 -newkey rsa:4096 -keyout <PRIVATE_KEY_NAME>.pem \
    -out <PUBLIC_KEY_NAME>.pem -sha256 -days 365 -nodes
Enter information to identify your organization. You don’t need to fill out all the fields, but you should specify what you can.

​
Static IP addresses

All AS2 connections in your Stedi account use the same set of static IP addresses for outbound EDI. If you need to allowlist these addresses, please contact customer success for a full list.