AS2 vs SFTP vs VAN for EDI Transport: Cost and Failure Modes

The retailer's receiving clerk scans the trailer seal at 06:10, finds no advance ship notice for it, and keys 22 pallets by hand. Three weeks later a compliance deduction lands on the remittance. Your gateway log shows the 856 left at 21:47 the night before with an HTTP 200. Nobody looked at the receipt that came back, which said the partner could not decrypt the file.

Most EDI transport failures look like that: the bytes moved, but the proof of acceptance was missing, unread or never designed in. This guide shows what AS2, SFTP and a value-added network (VAN) each prove, what they cost per partner over three years, and which alarms catch a failed hand-off before the truck arrives rather than after the chargeback.

• What the comparison covers: receipts and their fields, drop-folder pickup proof, kilocharacter billing arithmetic, certificate and host-key calendars, and a traced ASN failure.
• What you can reuse: an owner matrix, a three-year cost model in dollars and rupees, an annotated AS2 receipt, and a per-partner selection checklist.

What each transport proves once a file leaves your gateway

AS2 can return a signed, per-message receipt; SFTP proves only that a write to a remote folder succeeded; a VAN proves that its mailbox accepted custody. Those three different kinds of evidence, not encryption strength, should drive the choice for each trading partner.

AS2 is defined in RFC 4130, published in July 2005. A sender POSTs an S/MIME package over HTTP or HTTPS and can ask for a Message Disposition Notification, the receipt format now specified in RFC 8098. That receipt can be signed and can carry a digest of what the receiver actually got, so the sender holds evidence that a named partner received an unaltered file.

• SFTP drop folders: the file transfer runs inside an SSH session, and the client knows the write completed. The protocol itself has no receipt and no notion of whether the partner's job ever collected or parsed the file. The SFTP drafts at the IETF expired without becoming an RFC, so behaviour varies between servers.
• VAN mailboxes: you upload to the network, which routes the interchange into the partner's mailbox, sometimes across an interconnect to a second network. Evidence comes as the network's tracking reports, which show delivery to a mailbox and, depending on the service, retrieval by the recipient.
• Functional acknowledgments: whichever pipe you use, the X12 997 or 999 returned later confirms that the partner's translator accepted the syntax. The transport receipt and the functional acknowledgment answer different questions, and you need both.

Our EDI trading partner onboarding guide covers envelope identifiers, mapping tests and the 997 exit criteria. This article stays below that layer, on the pipe itself. Ownership is where most gateways go wrong, because certificates, keys and mailbox contracts often sit with different teams.

Reading an AS2 receipt: disposition, MIC and the error modifiers

An AS2 delivery is proven only when a signed receipt says "processed" with no error modifier and its digest matches the one you computed. An HTTP 200 on the POST means the web server answered; it says nothing about decryption, signature checks or whether the payload survived intact.

RFC 4130 lets the sender choose a synchronous receipt, returned in the HTTP response to the POST, or an asynchronous one sent later on a separate connection to a URL named in the Receipt-Delivery-Option header. Signed receipts are requested through Disposition-Notification-Options, which names the signature protocol and the preferred digest algorithms. The receipt body is a multipart/report whose machine-readable part carries the fields the gateway must parse.

POST /as2/inbound HTTP/1.1
AS2-Version: 1.1
AS2-From: SHIPPERCO-PROD
AS2-To: RETAILX-AS2
Message-ID: <20261111-2147-856-000418@gw.shipperco.example>
Disposition-Notification-To: edi-ops@shipperco.example
Disposition-Notification-Options: signed-receipt-protocol=optional, pkcs7-signature;
  signed-receipt-micalg=optional, sha-256
Content-Type: application/pkcs7-mime; smime-type=enveloped-data

--- machine-readable part of the signed receipt returned ---
Reporting-UA: RETAILX-AS2-GATEWAY
Original-Recipient: rfc822; RETAILX-AS2
Final-Recipient: rfc822; RETAILX-AS2
Original-Message-ID: <20261111-2147-856-000418@gw.shipperco.example>
Disposition: automatic-action/MDN-sent-automatically; processed/error: decryption-failed
Received-Content-MIC: q2Jx8Yt0cL5mR1vN4sWbE9kP7aD3fH6uZ0iQyTgXo1M=, sha-256

Gateway acceptance rule (all must be true):
  receipt.Original-Message-ID == sent.Message-ID
  receipt signature verifies against the partner certificate on file
  Disposition type == processed AND no "error:" modifier present
  Received-Content-MIC == digest computed before sending

RFC 4130 section 7.4.3 lists the error modifiers a receiver can return: authentication-failed, decompression-failed, decryption-failed, insufficient-message-security, integrity-check-failed and unexpected-processing-error. Each one points at a different fix, from a stale certificate to a compression mismatch, so the gateway should route them to different queues rather than one generic failure alert.

AS2 delivery under RFC 4130 counts as proven only when the gateway matches each outbound Message-ID to a signed receipt whose Disposition reads processed without an error modifier and whose Received-Content-MIC equals the digest computed before sending; a practical alert window is 10 minutes after the POST.

SFTP drop folders need a pickup proof you design yourself

SFTP gives you an encrypted, authenticated session and a completed write, nothing more. If you rely on it for ASNs, invoices or tenders, you must agree a pickup signal with the partner and alert when it does not appear.

The common failure is a partial read. Your job writes a 2.8 MB 856 batch while the partner's poller, running every two minutes, collects whatever is in the folder. If it lands mid-write, the partner parses a truncated interchange, rejects it, and your side sees a clean transfer. The second failure is silence: the partner's poller stops, files pile up in the outbox, and nothing on your side errors.

• Write then rename: upload as .tmp or into a staging folder, then rename to the final name only after the write closes. Agree that the partner's job ignores anything still carrying the temporary suffix.
• Pickup evidence: treat the partner deleting or moving the file to an archive folder as the receipt. Poll for that change and alert if a file is still present 30 minutes after placement during business hours.
• Checksum sidecar: for large batches, place a SHA-256 file alongside the payload so the partner can confirm the content matches before parsing.
• Host-key pinning: store the partner server's host-key fingerprint and fail the session if it changes. A silent re-key during a server migration is common, and auto-accepting the new key removes the protection SSH provides.
• Functional acknowledgment window: because the pipe gives no receipt, the 997 becomes the first business-level proof. Set its deadline tighter for SFTP partners than for AS2 partners.

SFTP suits partners who send large batch files at fixed times, such as a carrier's nightly freight invoice run or a 3PL's end-of-day inventory snapshot. It suits poorly any flow where a missing file costs money within hours, unless you build the polling above. For the wider question of whether EDI or APIs should carry a given flow, see our EDI versus API architecture comparison.

VAN mailboxes and the kilocharacter bill behind every interchange

A VAN removes point-to-point setup work but turns every interchange into a metered charge. Before choosing it, model your bill from real file sizes, because per-document minimums and interconnect fees usually matter more than the headline rate.

Many VAN contracts price traffic per kilocharacter, meaning 1,000 characters of EDI data, often charged on both sent and received documents, with a minimum billable size per document and a monthly mailbox fee. Exact terms vary by contract, so the arithmetic below uses illustrative rates; replace them with the figures in your own rate schedule before deciding anything.

• Billable size per document: billable kilocharacters for a document equal its character count divided by 1,000, rounded up, or the contract minimum if that is larger. A 230-character 997 can bill as a full kilocharacter.
• Monthly traffic charge: sum the billable kilocharacters for every document sent and received in the month, then multiply by the rate per kilocharacter.
• Fixed lines: add the mailbox fee, any interconnect fee charged when the partner sits on a different network, and archive or retrieval fees if you request old documents.
• Reconciliation check: compare the network's monthly kilocharacter count with the byte totals in your own gateway log. A gap of more than 2% usually means duplicate sends or minimum-size rounding you did not model.

The arithmetic punishes small documents. A partner who sends one 856 per carton rather than one per shipment, or who returns a 997 for every transaction set group, can double billable kilocharacters without changing the business volume. Ask partners to batch where their guide allows it.

Certificates, host keys and the shrinking TLS lifetimes from 2026

Expired credentials cause more transport outages than network faults. Every AS2 partner adds at least three expiry dates to track, and public TLS certificates now expire far sooner than many renewal processes were designed for.

An AS2 connection involves your signing certificate, your encryption certificate, the partner's equivalents and, where the endpoint uses HTTPS with a publicly trusted certificate, a TLS certificate on each side. The CA/Browser Forum Baseline Requirements, section 6.3.2, cap public TLS subscriber certificates issued on or after 15 March 2026 at 200 days. The cap falls to 100 days from 15 March 2027 and to 47 days from 15 March 2029.

Public TLS certificates on an AS2 or HTTPS EDI endpoint issued on or after 15 March 2026 cannot exceed 200 days under CA/Browser Forum Baseline Requirements section 6.3.2, falling to 100 days from 15 March 2027, so the gateway certificate calendar needs at least two endpoint rotations a year.

The AS2 signing and encryption certificates are exchanged directly between partners and are often self-signed, so the Forum's cap does not govern them. Their risk is different: a partner rotates its encryption certificate, emails the new one to a shared inbox, and your gateway keeps encrypting to the old key. The receiver then returns decryption-failed receipts until someone updates the profile.

• Thirty-day warning: alert on every own and partner certificate 30 days before expiry, and again at 7 days, with the partner name and AS2 identifier in the alert.
• Overlap window: agree that the receiving side accepts both the old and the new certificate for an overlap period, usually one to two weeks, so cutover does not depend on both teams acting at the same hour.
• Digest algorithm review: RFC 4130 examples use SHA-1, and RFC 8551 marks sha-1 and md5 as historical micalg values no longer considered secure. NIST has deprecated SHA-1 for new digital signatures and set 31 December 2030 to complete its transition away from SHA-1, so request sha-256 receipts.
• SFTP key rotation: rotate your client keys on a fixed schedule and keep the partner's host-key fingerprint under change control rather than accepting new keys automatically.

Indian operators carry an additional logging duty. CERT-In's directions of 28 April 2022, issued under section 70B(6) of the Information Technology Act, 2000, apply to service providers, intermediaries, data centres, body corporate and government organisations, which covers most companies running an EDI gateway in India.

Indian companies running an EDI gateway fall under CERT-In Directions of 28 April 2022 under IT Act section 70B(6): AS2, SFTP and VAN session logs must be kept for a rolling 180 days within Indian jurisdiction, system clocks synchronised to NIC or NPL time, and reportable cyber incidents notified within 6 hours.

One missed ship notice traced from the POST to the deduction

The incident below is a composite of a common pattern. The transport worked, the receipt reported the failure, and the gateway's alert rule ignored the field that mattered.

1. Wednesday 23:05: the retailer installs a new AS2 encryption certificate and emails it to the supplier's shared EDI inbox, where it sits unread overnight.
2. Thursday 21:47: the supplier's gateway POSTs interchange control number 000418, an 856 for shipment SH-77310 with 22 pallets, still encrypted to the retired certificate. The synchronous receipt returns "processed/error: decryption-failed" inside an HTTP 200.
3. Thursday 21:47: the gateway's alert watches HTTP status codes only, so the transaction is marked "sent" and no 997 timer is set for this partner.
4. Friday 06:10: the trailer arrives at the retailer's distribution centre with no matching ASN; receiving keys the pallets manually and logs a compliance exception against purchase order 4500918822.
5. Three weeks later: the remittance advice carries a deduction for the missing ASN, and the supplier's analyst finds the decryption error only by reading the archived receipt.

Under the controlled design, the gateway parses the Disposition field, sees the error modifier at 21:47 and opens a high-priority ticket. The on-call analyst finds the certificate email, imports it, and resends with the same content by 22:30, well before the trailer is due. A 997 deadline of four hours would have been a second safety net.

Three-year transport cost per trading partner in dollars and rupees

For a steady, mid-volume partner, AS2 and SFTP cost a fraction of a metered VAN over three years, but only after paying an upfront setup cost and monthly monitoring time. The model below makes those labour lines explicit, because they are what spreadsheets usually leave out.

Assumptions, all illustrative: one partner exchanging 9,920 billable kilocharacters a month in both directions; VAN at $0.10 or ₹7 per kilocharacter plus a mailbox fee of $75 or ₹4,000 a month; internal labour at $85 or ₹1,500 an hour. Gateway licence and hosting figures are allocated shares, not vendor prices. All amounts exclude sales tax and GST.

The VAN column grows linearly with traffic, while the AS2 and SFTP columns are mostly fixed. Rerun the model at your own volumes: at 800 kilocharacters a month, the US VAN total falls to $8,640 over three years, well below the $14,410 AS2 figure, which is why low-volume partners usually stay on a mailbox.

The model also hides one asymmetry. A single missed ASN deduction or a late-invoice penalty can exceed a year of transport cost, so the monitoring line is the one not to cut. SFTP looks cheapest here only because pickup polling was built and budgeted; without it, the comparison is not like for like.

Gateway rules that block or alert, and where an assistant helps

Receipt matching, digest comparison and expiry alerts are fixed rules the gateway should enforce without anyone deciding. Software assistants are useful for reading unstructured partner messages and summarising logs, but a person approves any change to a partner profile.

Choosing a transport per partner and moving off a VAN safely

Pick the transport per partner, not once for the company. High-volume, time-critical partners belong on AS2 with strict receipt checks; batch partners suit SFTP with pickup polling; long-tail and mandated partners can stay on a VAN.

A migration from a VAN to direct AS2 is a cutover, not a configuration change. Run the new connection in parallel with production traffic still on the VAN, compare what arrives, and switch one document type at a time, starting with low-risk flows such as 997s before invoices or ship notices. The 856, 940/945 and 204/214 integration overview helps decide which flows are time-critical. The freight tender triage and variance reconciliation page covers what happens after a tender is delivered; this guide covers only whether it got there.

If you are replacing a gateway or bringing VAN partners in-house and want a second pair of eyes on the partner list, receipt rules and cutover plan, you can send us your requirements. More transport and message guides are in the logistics and supply chain library.