Transfer Encryption

Encrypted connections protect file contents and credentials while they travel between systems. HTTPS and FTPS use TLS; SFTP uses SSH. Each connection must agree on supported encryption algorithms, often called ciphers, before the user authenticates. Files.com balances secure defaults with compatibility for the clients your organization needs.

Connection encryption is separate from GPG file encryption, which keeps a delivered file unreadable until its recipient decrypts it. A TLS certificate or SFTP host key also lets the client verify the server's identity. Custom Domain certificates and SFTP host keys have their own administration and trust requirements.

Files.com requires modern, secure encryption by default. A separate setting allows connections to negotiate legacy ciphers with known weaknesses so that outdated clients, systems, and devices can connect.

We do not recommend enabling that setting. It applies to all SFTP connections on your site and cannot be limited to the clients that need it, so accommodating one outdated system expands the algorithms available to every SFTP client. Enable it only when a business-critical client cannot negotiate modern ciphers and cannot be upgraded.

If your site already allows legacy ciphers, determine which ciphers are being used to find the connections that still depend on them. The reports give you current and historical information about how each of your users' connections are affected, so you can upgrade the affected clients and then turn the setting back off.

Files.com maintains separate default and legacy cipher options so that older-client compatibility requires an explicit site-wide choice.

A Note About the Term SSL / TLS

TLS is the modern standard that replaces SSL. When either term appears without a specific version number (such as TLSv1.3), our documentation and website use TLS and SSL interchangeably.

Default Secure Ciphers

By default, Files.com uses TLS v1.3 for HTTP connections and TLS v1.2 for FTP. TLS v1.2 is also supported for HTTP and is configured to provide the same level of security as TLS v1.3.

Our SSL configuration holds an A+ Rating from the Qualys SSL grader.

HTTPS

Files.com supports the following TLS v1.3 cipher suites for HTTPS:

TLS_AKE_WITH_AES_256_GCM_SHA384 (ecdh_x25519)
TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519)
TLS_AKE_WITH_AES_128_GCM_SHA256 (ecdh_x25519)

Files.com supports the following TLS v1.2 cipher suites for HTTPS:

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (ecdh_x25519)
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 4096)
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (dh 4096)
TLS_DHE_RSA_WITH_AES_256_CCM (dh 4096)

FTPS

Files.com supports the following TLS v1.2 cipher suites for FTPS:

TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 2048)
TLS_RSA_WITH_AES_128_CBC_SHA (rsa 4096)
TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 2048)
TLS_RSA_WITH_AES_256_CBC_SHA (rsa 4096)
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1)
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1)
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (dh 2048)
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (secp256r1)
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (secp256r1)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp256r1)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp256r1)
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (dh 2048)
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (dh 2048)

A Note About CBC Ciphers

The FTPS list includes both CBC and GCM cipher modes to support different clients. A supported algorithm is not necessarily the one a client selects. Transfer Encryption & Algorithms explains how to interpret a connection's algorithms alongside your organization's requirements.

SFTP

SFTP does not use TLS or SSL. It implements its own encryption standards and cipher naming.

By default, Files.com supports the following security algorithms for SFTP:

A Note About HMAC-SHA1

Files.com supports hmac-sha1 and hmac-sha1-etm@openssh.com for SFTP client compatibility. These are message authentication algorithms. Algorithm Roles explains how their purpose differs from encryption and certificate signatures, and cipher reporting identifies what your clients use.

Connection Algorithm Reports

Keeping your site secure depends on knowing who is using weak or outdated encryption. If you've enabled insecure ciphers for SFTP connections, some users may still connect with old settings that aren't safe.

Your site includes reports that list which ciphers your users are connecting with. Use these reports to identify affected users, move their connections to stronger options, and then safely disable the insecure ciphers for your site.

Web Interface

Two data exports are available to show you who is connecting with insecure ciphers.

To view which ciphers a specific user is connecting with, access their user record within the web interface. In the Connections tab, a listing of Protocols & Ciphers shows every way they have connected, including whether each connection was secure and when they last used it. You can filter the listing and export this data.

For an overall view of every user connecting with insecure ciphers, review the Users Using Insecure Ciphers listing. This listing covers every user who has connected using an insecure cipher and shows when each user most recently connected with each cipher. That makes it straightforward to track progress as you update affected users.

Programmatic

You can use the Files.com Command Line App (CLI) or any of the official Files.com SDKs to generate a report of your users that are connecting with insecure ciphers.

Connection Problems

A connection must negotiate encryption before the account can authenticate. SFTP troubleshooting addresses SSH key exchange failures. TLS troubleshooting addresses HTTPS and FTPS compatibility and network filtering. Changing a password or folder permission does not resolve an encryption negotiation failure.