TLS certificates let a client confirm the identity of the server it connects to. Files.com provides valid, chained certificates for its own hostnames and can issue and renew the certificate for your Custom Domain. You can instead provide a certificate obtained from another issuer.

Files.com-managed certificates are the default and recommended choice. Your organization controls DNS for the Custom Domain; Files.com handles certificate issuance and renewal. Providing your own certificate makes your organization responsible for maintaining its certificate, private key, and chain of trust.

Certificate Management Choice

Use a Files.com-managed certificate when you want automatic issuance and renewal. Organizations with an established certificate-management process can supply their own certificate. A requirement for an Organization Validation (OV) or Extended Validation (EV) certificate also calls for a customer-provided certificate; Files.com-managed certificates use Domain Validation (DV). You can change the certificate-management choice later.

When you choose your own certificate, Files.com disables its CAA records so you can request a certificate from another issuer.

API, FTP, SFTP, and WebDAV Connections

Your SSL certificate will be served for any connections to your site that involve TLS encryption, which includes the web interface, the REST API, FTP, and WebDAV.

SFTP will not serve the SSL certificate, since that protocol uses SSH encryption instead of TLS.

Once you set up and activate your own SSL certificate, only connections initiated to your site via your custom domain will use that certificate.

Connections via your Custom Subdomain will still use our Files.com certificate, since your certificate would not be valid for our domain.

Plan Ahead to Minimize Downtime

You can minimize the downtime involved in switching between a Files.com certificate and your own SSL certificate by setting your CNAME records to a low TTL before you make the switch. Set the Time-To-Live (TTL) duration for your CNAME DNS records to no more than 60 seconds.

When switching to your own SSL certificate, upload and activate the certificate, then update your CNAME record to the target shown under DNS Configuration in the SSL Certificates settings. With a sufficiently low TTL, you will likely see only a few minutes of disruption before your certificate is served for your site.

Using an SSL Certificate Provided by Files.com

Files.com gives you SSL certificates for custom domains at no cost.

Short-lived certificates reduce how long a disclosed private key could remain usable, and automated renewal reduces manual certificate-maintenance errors. Once your certificate is set up, you don't need to do anything to keep it active because we automate the renewals. We use a trusted Certificate Authority called Let's Encrypt to create these certificates, which are valid for 90 days. Our system renews certificates well before they expire, usually at least two weeks before the expiration date, although the timing may vary by a few days.

To set up your custom domain to use an SSL certificate provided by Files.com, create your CNAME record pointing your custom domain to your Files.com subdomain (e.g. [subdomain].files.com).

Once you have created the CNAME record, you can complete the setup of your custom domain by adding your custom domain in Files.com.

Certificate provisioning in Files.com is very fast. We are generally able to provision and activate a certificate in 10-15 minutes after the DNS change has propagated and the domain has been added to Files.com according to our instructions.

Using Your Own SSL Certificate

If you prefer to use your own SSL certificate rather than one provided by Files.com, you will first need to configure your Custom Domain to use your own certificate and then upload and activate your SSL certificate through the web interface. If you wish to avoid using dedicated IP addresses for your custom subdomain, you must provide your own SSL certificate.

Configure your Custom Domain by changing its Who will register SSL Certificates for this domain? setting to the Use my own certificate option. When you make this change, Files.com will disable its CAA records, allowing you to request a certificate for your domain from another issuer.

If you have already obtained your SSL certificate, upload it and activate it within the SSL Certificates settings. You will need to provide the certificate's private key (and key password if the key is encrypted), the certificate itself, and the intermediate certificates from your certificate authority.

If you haven't yet obtained a certificate, you'll need to generate a certificate signing request (CSR). Use the Files.com web interface Generate CSR link to generate a new secure key pair and CSR which you can provide to an accredited SSL Certificate authority when purchasing an SSL certificate. For multi-domain SAN certificates, supply each of the Additional Domains the certificate needs to cover.

Many SSL vendors also provide their own CSR tool if you prefer to generate the CSR outside of Files.com. Some SSL vendors request the web server type as part of the certificate generation process. Files.com requires a certificate in OpenSSL format, which can usually be obtained by choosing the option for Apache, Linux, or Other.

We recommend a certificate used only by Files.com and scoped to the exact hostname, such as files.your-domain.com, so you can manage and replace its credentials independently of other services. A wildcard certificate is also supported when it covers the hostname you configure. It does not automatically enable other matching hostnames; each Custom Domain must be defined.

After uploading your SSL certificate and its intermediate certificates, you must activate it. In the SSL Certificates settings, copy the exact CNAME target displayed for your domain under DNS Configuration. Targets can differ between domains on the same site, so confirm the value for each domain to route connections to the addresses serving its certificate.

After you have created the CNAME record, you can complete the setup of your custom domain by updating your custom domain setting in Files.com.

To have Files.com take over certificate issuance and renewal for your Primary Custom Domain, switch to a Files.com certificate.

Certificate Chain

When using your own SSL Certificate, its chain of trust must be valid.

Always include the intermediate certificates that were provided with your certificate when importing into Files.com.

If the intermediate certificates are missing, or do not correspond to the certificate, then users and clients will see warnings or errors stating that the connection is insecure.

Renewing Your Custom SSL Certificate

When using your own SSL Certificate, you are responsible for managing the renewal of the certificate. Renew any expiring SSL Certificate prior to its expiration date and time. This applies to all certificate types, including Single Domain, Wildcard, or Multi Domain (SAN/UCC/MDC) certificates. Contact your SSL Certificate Provider if you have any questions about the process.

Files.com can assist in creating the Certificate Signing Request (CSR) for the renewal. You can generate a new CSR using the Generate CSR option, which will provide you with a CSR that you can submit to your SSL Certificate Provider. You can also use the Renew option of an SSL Certificate to generate an updated CSR for that certificate.

Once your SSL Certificate Provider has provided you with your renewed SSL Certificate, import the certificate, its intermediate certificates, and its private key. Successfully imported certificates will show an Available status.

Only one certificate can be Active at a time. Use the Activate option of a certificate to make that certificate the active certificate for your site. Activating a certificate will automatically deactivate the previously active certificate. Deactivated certificates will have a status of Available or Expired depending on their validity.

Activating a certificate takes effect immediately for new connections. Existing connections, especially those that use caching, may take some time to register the change and start using the new certificate. Usually this takes a few seconds but might take a few minutes depending on the caching duration settings of the client application.

Applying and activating a renewed SSL Certificate will not change your custom domain or its dedicated IP addresses.

Switching From Custom SSL to Files.com SSL

Files.com can take over certificate issuance and renewal for your Primary Custom Domain by replacing the active custom certificate in place. The switch keeps the same dedicated IP addresses and works with a Custom Username Namespace enabled. You do not need to disable the namespace or deactivate your custom certificate.

About a day before the switch, reduce the Time-To-Live (TTL) of your CNAME record to 60 seconds. Allow the previous TTL to elapse before changing the record's target so cached DNS records expire before the switch. A low TTL minimizes the disruption caused by the DNS change.

Sign in as a Site Administrator through your Files.com subdomain, [subdomain].files.com, to perform the switch. Your custom domain is unavailable from the CNAME change until the Files.com certificate is active, usually a few minutes. Using your Files.com subdomain lets you continue administering the site during that interruption.

Before changing DNS, note the current CNAME target shown for your Primary Custom Domain under DNS Configuration in the SSL Certificates settings. This is the target to restore if the Files.com certificate cannot be issued.

When you're ready to make the switch:

At your DNS provider, change the CNAME target for your Primary Custom Domain to [subdomain].files.com.
Wait at least twice the CNAME record's TTL after changing its target to give the DNS change time to propagate. With a TTL of 60 seconds, wait at least 120 seconds (2 minutes) before starting the certificate switch in Files.com.
From [subdomain].files.com, open the SSL Certificates settings. In the active custom certificate's menu, choose Switch to a Files.com certificate.

Files.com checks that the CNAME points at your Files.com subdomain before accepting the switch. If it does not, the switch is rejected with an error naming the required target. Once accepted, the switch automatically sets Who will register SSL Certificates for this domain? to Files.com and starts issuing the new certificate.

The custom certificate stays active until the Files.com certificate replaces it on the same dedicated IP addresses. When the switch is complete, the Files.com certificate has an Active status and your custom domain is available again. Files.com then manages renewal of the new certificate.

If the Files.com certificate cannot be issued, your custom certificate remains active. Point the CNAME back at the target you noted under DNS Configuration to restore access through your custom domain.

While it is possible at this point to increase the TTL for your CNAME record, we strongly recommend leaving this value at 60 seconds.

Insecure SSL Connection Warnings

When using your own SSL certificate, ensure that you have imported the correct certificate and its corresponding intermediate certificate(s). Incorrectly configured SSL certificates will display warnings or errors stating that the connection is insecure when users connect.

One common failure pattern is not including the intermediate certificates when you import your certificate to your Files.com site. Missing or incorrect intermediate certificates will cause security error messages to be presented to users and clients.