Capability Support
AS2 version 1.1 (RFC 4130 + RFC 5402 compression) Transport HTTP; TLS terminated at your ingress/load balancer Directions Full send and receive Signing RSA PKCS#1 v1.5 and RSASSA-PSS; MD5, SHA-1, SHA-224/256/384/512 Encryption 3DES, RC2, AES-128/192/256-CBC, AES-128/192/256-GCM (CAST5/IDEA present but excluded from support — see Algorithms ) Compression ZLIB (RFC 3274), before or after signing; double-compression rejected MDNs Sync and async; signed and unsigned; requested per partner MIC Full RFC 4130 §7.3/§7.4 rules incl. micalg negotiation and 3851/5751 name normalization Identifiers AS2 quoted-name support both directions (§6.2) Authentication HTTP Basic to partner endpoints; pinned-certificate verification of partners
Capability Support
Replay protection Message-ID dedup store with TTL; duplicate deliveries re-answered idempotently Retries Durable queue, exponential backoff with jitter, restart-safe; transient failures only (connect errors, 408/429/5xx) Message journal Every business event persisted and emitted as structured logs Large payloads Spooled to disk, multi-GiB verified Health GET /healthz (reports degraded states in the body, always HTTP 200)Logging JSON (default) or text to stdout; level configurable; RUST_LOG override Metrics Optional Prometheus endpoint on a dedicated port (never on the partner-facing listener) Shutdown Graceful on SIGTERM/SIGINT — in-flight exchanges finish
Backend Use case
SQLite + filesystem (default) Single replica, zero external services PostgreSQL Multi-replica, scale-out, scale-to-zero (any Postgres: in-cluster, managed, free tiers) Azure Blob Storage Optional payload store override, composable with either Azure Key Vault Optional private-key store override (managed identity supported)
One image for all of them: Docker/compose, Kubernetes via the provided
Helm chart (AKS, EKS, k3s, bare metal), Azure Container Apps
(scale-to-zero bicep template provided), and any other container platform.