Troubleshooting TLS Connections

Files.com uses Transport Layer Security (TLS) to protect HTTPS and FTPS connections. A network device that inspects and re-encrypts this traffic can prevent a browser or client app from establishing the secure connection it expects. Use this guidance when connections fail on a particular network with TLS or SSL errors.

Files.com's TLS configuration earns an A+ score on the Qualys SSL Grader tool.

Issues With Content Filtering

On some networks, users receive SSL error messages that include the text "This site can't provide a secure connection" and ERR_SSL_PROTOCOL_ERROR. These errors can also present as CORS errors.

Most of the time, this is caused by a network that is intercepting HTTPS traffic and re-encrypting it using a certificate that does not belong to Files.com. Corporate networks may inspect traffic this way to enforce content-filtering or data-loss-prevention policies.

A browser or application cannot rely on your organization's approval of the network device to establish that the connection is secure. It still needs to verify the certificate presented for the connection.

The vendors and product names we typically see associated with this sort of activity include ZScaler, Symantec WSS, Comcast Business, Palo Alto, SecurityEdge, and Akamai, but there are many others.

Solutions

You have a few options to address problems created by SSL/TLS Protocol filtering. It's not possible to disable or alter Files.com's TLS requirements, but you may be able to change your connection.

Update Network/Firewall Configuration

The typical solution is for the network or firewall administrator to whitelist traffic on *.files.com or [subdomain].files.com so that the filtering does not interfere with our SSL traffic. Files.com continues to serve a secure, encrypted connection even without SSL/TLS protocol filtering.

Configure a Custom Domain

You may be able to avoid firewall situations like this with our Custom Domain feature. With a custom domain, your users access your Files.com site via your own domain (for example, files.[YOURDOMAIN].com) instead of a files.com subdomain. We provide a matching SSL certificate and two dedicated IP addresses exclusive to your site as part of this feature.

Use Another Network or VPN

Alternatively, you can connect to Files.com via a VPN or another network that will not interfere with Files.com's SSL traffic.

CuteFTP "Error in negotiating SSL connection"

CuteFTP versions prior to 9.2.0 do not support the ciphers needed for Files.com to operate securely. Upgrade to CuteFTP 9.2.0 or later, which fully supports secure encryption.

Error connecting to REST API with .NET ("An unexpected error occurred on a send")

A .NET client can fail to negotiate TLS because it is configured to use an older protocol or its operating system selects one. Files.com supports TLS 1.2 for HTTPS, so a client does not need TLS 1.3 to connect.

For applications targeting .NET Framework 4.7 or later, Microsoft recommends allowing the operating system to choose the TLS version rather than hard-coding an older version. Check the application's target framework, explicit protocol settings, and the protocols enabled on its operating system. Microsoft's TLS guidance explains the settings for earlier framework targets and different networking libraries.

Update the application and its runtime when they cannot negotiate a supported TLS version. The SFTP legacy-algorithm setting does not change HTTPS or FTPS compatibility.