Transfer Encryption

Encrypted connections protect file contents and credentials while they travel between systems. HTTPS and FTPS use TLS; SFTP uses SSH. Each connection must agree on supported encryption algorithms, often called ciphers, before the user authenticates. Files.com balances secure defaults with compatibility for the clients your organization needs.

Connection encryption is separate from GPG file encryption, which keeps a delivered file unreadable until its recipient decrypts it. A TLS certificate or SFTP host key also lets the client verify the server's identity. Custom Domain certificates and SFTP host keys have their own administration and trust requirements.

For SFTP, Files.com requires modern, secure encryption by default. The SFTP Ciphers setting can allow connections to negotiate legacy ciphers with known weaknesses so that outdated clients, systems, and devices can connect.

We do not recommend enabling legacy support. The setting applies to all SFTP connections on your site and cannot be limited to the clients that need it, so accommodating one outdated system expands the algorithms available to every SFTP client. Enable legacy support only when a business-critical client cannot negotiate modern ciphers and cannot be upgraded.

If your site already allows legacy ciphers, determine which ciphers are being used to find the connections that still depend on them. The reports give you current and historical information about how each of your users' connections are affected, so you can upgrade the affected clients and then turn the setting back off.

Files.com maintains separate default and legacy cipher options for SFTP so that expanding SFTP cipher support requires an explicit site-wide choice. FTPS has its own supported cipher list, including the CBC compatibility described below.

A Note About the Term SSL / TLS

TLS is the modern standard that replaces SSL. When either term appears without a specific version number (such as TLSv1.3), our documentation and website use TLS and SSL interchangeably.

Default Secure Ciphers

Files.com supports TLS v1.3 and TLS v1.2 for HTTPS, and TLS v1.2 for FTPS. The supported cipher suites differ by protocol to accommodate the clients that use each service.

Our SSL configuration holds an A+ Rating from the Qualys SSL grader.

HTTPS

Files.com supports the following TLS v1.3 cipher suites for HTTPS:

TLS_AKE_WITH_AES_256_GCM_SHA384 (ecdh_x25519)
TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519)
TLS_AKE_WITH_AES_128_GCM_SHA256 (ecdh_x25519)

Files.com supports the following TLS v1.2 cipher suites for HTTPS:

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (ecdh_x25519)
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 4096)
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (dh 4096)
TLS_DHE_RSA_WITH_AES_256_CCM (dh 4096)

FTPS

Files.com supports the following TLS v1.2 cipher suites for FTPS:

TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 2048)
TLS_RSA_WITH_AES_128_CBC_SHA (rsa 4096)
TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 2048)
TLS_RSA_WITH_AES_256_CBC_SHA (rsa 4096)
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1)
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1)
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (dh 2048)
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (secp256r1)
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (secp256r1)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp256r1)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp256r1)
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (dh 2048)
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (dh 2048)

A Note About CBC Ciphers

Files.com supports AES in both CBC and GCM modes for FTPS. A substantial amount of FTP traffic depends on older clients and managed file transfer systems that support CBC but cannot negotiate GCM. Retaining CBC support lets those integrations continue using encrypted FTP. This support is part of the standard FTPS configuration and is separate from the legacy SFTP setting.

TLS v1.2 and protections in the TLS implementation mitigate known CBC concerns. GCM remains the preferred choice for clients that support it. Use connection algorithm reports to identify what your clients actually negotiate and assess it against your organization's requirements. Transfer Encryption & Algorithms explains the protections and their limits.

SFTP

SFTP does not use TLS or SSL. It implements its own encryption standards and cipher naming.

By default, Files.com supports the following security algorithms for SFTP:

The server host key algorithms listed above apply to the default Files.com host keys. Clients that support RSA receive the RSA key; clients that support ED25519 but not RSA receive the ED25519 key. Custom host key algorithms depend on the keys you configure.

A Note About HMAC-SHA1

Files.com supports hmac-sha1 and hmac-sha1-etm@openssh.com for SFTP client compatibility. These are message authentication algorithms. Algorithm Roles explains how their purpose differs from encryption and certificate signatures, and cipher reporting identifies what your clients use.

Connection Algorithm Reports

Keeping your site secure depends on knowing who is using weak or outdated encryption. If you've enabled insecure ciphers for SFTP connections, some users may still connect with old settings that aren't safe.

Your site includes reports that list which ciphers your users are connecting with. Use these reports to identify affected users, move their connections to stronger options, and then safely disable the insecure ciphers for your site.

Web Interface

Two data exports are available to show you who is connecting with insecure ciphers.

To view which ciphers a specific user is connecting with, access their user record within the web interface. In the Connections tab, a listing of Protocols & Ciphers shows every way they have connected, including whether each connection was secure and when they last used it. You can filter the listing and export this data.

For an overall view of every user connecting with insecure ciphers, review the Users Using Insecure Ciphers listing. This listing covers every user who has connected using an insecure cipher and shows when each user most recently connected with each cipher. That makes it straightforward to track progress as you update affected users.

Programmatic

You can use the Files.com Command Line App (CLI) or any of the official Files.com SDKs to generate a report of your users that are connecting with insecure ciphers.

Connection Problems

A connection must negotiate encryption before the account can authenticate. SFTP troubleshooting addresses SSH key exchange failures. TLS troubleshooting addresses HTTPS and FTPS compatibility and network filtering. Changing a password or folder permission does not resolve an encryption negotiation failure.