Using SSL

This page explains how to set up SSL to send and receive files securely via FTP. For more detailed information on what each option of the 'Security' dialog performs, please see Important Security Considerations.

What is SSL? #

The Secure Socket Layer (SSL) is used to encrypt data as it is sent down a connection. This protects data from being intercepted for malicious use via what is referred to as a 'man in the middle' attack. With SSL, if any information is intercepted it will be useless without the relevant information needed to decrypt it. Therefore when using SSL, you have a guarantee that the data you send and receive is always safe and secure.

Certificates #

SSL also deals with authenticating both client and server by using certificates to validate their identity. This is especially important for preventing a 'masquerade' attack. This is where a third party can actually pretend to be your server in order to gain sensitive material or send harmful viruses to your users. SSL certificates ensure that the server you are connecting to is the server you intended to connect to.

Configuring SSL #

When using SSL with Ability FTP Server, there are a few things that you need to understand in order to configure your server correctly. First of all, the server must have at least one certificate for SSL connections to use. These will be used to validate the servers identity to clients. Ability FTP Server supports two different modes for which SSL can be used, these are 'Explicit SSL' and 'Implicit SSL'.

Explicit SSL

Explicit SSL operates such that a connection to the server is made on the normal service port. Communication initially starts in plain text until the client issues an authentication command, which then leads to certificate verification and a secure SSL connection being negotiated. If all goes well, then the server and client will proceed to send all further commands and replies encrypted using SSL.

Implicit SSL

Implicit SSL allows the server to specify a different port dedicated to SSL communication. Any connections made to this port require immediate negotiation of certificates and SSL, avoiding any communication in plain text whatsoever.

Data Channel Encryption

The security standard for FTP states that the data channel remains insecure by default. This means that SSL encryption would usually only be enabled on the command channel. Although this would protect from eavesdropping of user names, passwords and file locations, the uploaded and downloaded files would remain vulnerable. By setting the data channel to be encrypted by default, the FTP client does not have to implicitly state encryption of the data channel. However, you must ensure that the FTP client is able to deal with an automatically encrypted data channel.

Certificates

On the Security tab of the settings dialog for Ability FTP Server, there is a button that will take you to the certificate management area. This area allows you to create and also import certificates to be used with the server's SSL communication. To use SSL, you must have at least one certificate installed in Ability FTP Server and you must also select one certificate as the default.

Creating Certificates #

Creating new certificates is the simplest method of acquiring a certificate. Simply click 'Create' and fill in the necessary information. If you are unsure of any field, you can always press F1 on any open dialog to open the manual on the relevant page. All certificates require a private key and Ability FTP Server will either create a 4096 bit key or 2048 bit key depending on your selection. Larger private keys will provide stronger security on your connections and so a 4096 bit key is recommended. Once all fields are completed, simply click 'Create' again and your new certificate will be generated and ready to use.

Certificate Signing Requests (CSR)

When you create a new certificate using Ability FTP Server, three files related to that certificate are generated in the 'certs' folder (usually C:\Code Crafters\Ability FTP Server 3\certs). These include a private key (.key) file, a certificate signing request (.csr) and a self signed certificate (.crt). Normally, you use the self signed certificate and corresponding private key for SSL communication. However, if you want to have your certificates signed by a trusted certificate authority, such as VeriSign, you can send them the certificate signing request (.csr) file. They can sign this and send you back a new certificate (.crt or .cer) file. To use this new certificate you must import this back into Ability FTP Server using the original private key (.key) and newly signed certificate (.crt or .cer). For more details on importing certificates please read below.

Importing Certificates #

If you choose to import an existing certificate, you must have access to the certificate file and the relevant private key used to create it. These can be in a range of formats. Usually a private key is contained in a '.key' file and the certificate in either a '.crt' or '.cer' file. However, it is also common to produce a combined private key / certificate pair in a single file suffixed '.pem'. Ability FTP Server can take any known format of RSA base64 encoded private keys and certificates. It then loads in the pair and checks the integrity to ensure that they match each other. Once the pair has been successfully checked, they are copied to the 'certs' folder in the '.key' and '.crt' format. If the files have different names (e.g. cert2.key / bobscert.crt) then the key is renamed to match the certificate (i.e. bobscert.key / bobscert.crt). You can also specify an entirely new name for both to be renamed to. For more information, please view the SSL Certificates page.