300

3.0.0

Disconnect the connection to the remote peer if the location has not received any requests for the configured number of seconds.

Keep-alive command requests are ignored, and the connection will be automatically disconnected if keep-alive is the only command requested in the configured interval.

Disconnected locations will automatically reconnect when a new request is made.

If the remote peer closed the connection before the local configured timeout, the connection is left closed, and it will be automatically recreated when a new command is requested.

Set to 0 to always keep the connection active, by forcing reconnection when the remote peer closes the connection.

0

3.0.0

Send a keep-alive command every N seconds to avoid having the connection disconnected by the other peer due to inactivity.

Set to 0 to disable keep-alive commands.

The keep-alive command does not reset the idle connection timeout,

12

3.9.0

Number of times to retry connection to the location, when the initial connection fails.

Set to 0 to not retry.

300

3.9.0

Number of seconds to wait between connection attempts.

Set to 0 to retry right away without any delay.

''

• MD5 Hexadecimal, delimited by colons

• SHA1 Base64

• SHA256 Base64

• OpenSSH Public Key

• X.509 certificate

• Multiple identities on multiple lines.

• set-on-first-connection

This configuration defines the identity of the remote SSH server.

It can be defined as an MD5, SHA1, or SHA256 fingerprint.

You can also define it as an OpenSSH public key or an X.509 SSL/TLS certificate.

To automatically configure with the identity of the server found during the first connection, you can use the set-on-first-connection option. For security reasons, we do not recommend this option. This option is not available for cluster operations when the remote SFTP service has more than one SSH server identity.

When you are connecting to a remote SSH / SFTP service which is deployed as a cluster or as a disaster recovery failover it is possible that each node/server from the cluster to have its own identity. You will need to configure SFTPPlus with the identity of each server by defining multiple identities on separate lines.

This configuration is mandatory and critical for securing the SSH connection. When the server's key fingerprint cannot be verified, all connections are rejected.

Empty

2.8.0

This option specifies the password used to connect to the remote SSH server. It is provided in plain text. To disable password authentication, set this to an empty string.

When ssh_private_key is defined and configured to a private key which is stored in encrypted mode, this holds the password used to decrypt the private key.

Empty

3.0.0

SSH private key used to authenticate to the remote SSH server. Leave it empty to disable SSH key authentication.

It can be configured with a path on the local filesystem containing the content of the SSH key.

You can also define the content of the SSH key directly as a text value. In this case the configuration will look like the following example. It's important to start each line with at least one space character and keep the number of leading spaces constant:

[locations/b904e6h6-c295-4ccf-8abd-edcae4d3324f]
name = SFTP Acme Server
type = sftp
ssh_private_key = -----BEGIN RSA PRIVATE KEY-----
    Proc-Type: 4,ENCRYPTED
    DEK-Info: AES-128-CBC,ACD9A45C68DD1924FF2A1A54BE2A7BF4

    RAHH7yMbPk/vrhT5jkSDGIUdH+nG0OQpeSWcQXd4JJ6pqdJh/cw/havtxlHFp1yz
    ...
    MORE SSH KEY CONTENT
    ...
    Pkf+23OGZln2dLz/pkJkiRRzmsWgT2hUv/EK4NYRQq1kEAXLf3J6xZqLlR3ZBLJm
    -----END RSA PRIVATE KEY-----

We recommend to store the key in PEM OpenSSH format, but Putty or Tectia formats are also supported.

When the configured key is encrypted, the value configured in password is used to decrypt the key.

Empty

• URI like expression.

• socks5://12.342.421.2:8899

• Empty

This option configures a proxy to be used when making connection to the remote server.

When no port is defined, it will use port 1080.

Leave it empty to disable proxy usage.

For now, only the SOCKS5 without authentication is supported. The DNS resolution will be delegated to the SOCKS server.

secure

• List of accepted key exchanges, HMACs and ciphers names.

• all

• secure

• fips

None

Empty

3.0.0

This option specifies the password used to connect to the FTP server.

It is defined in plain text format and sent over the network in plain text without any transport protection.

Empty

• Host name or IP address of the FTP server.

Address of the server. IP or host name.

In order to check the identity of the remote server the address should be provided as FQDN. IP addresses are not supported by the server identity validation process.

Empty

3.13.0

This option specifies the password used to connect to the server.

It is defined in plain text format and sent over the network protected by the TLS protocol.

Empty

• Fully qualified domain name (FQDN)

• Comma separated list of fully qualified domain names

• Empty

Empty

• Absolute path on the local filesystem.

• Certificate in PEM text format (Since 3.40.0).

• Certificate in PKCS12 / PXF binary format (Since 4.0.0).

• Empty

None

Empty

• Absolute path on the local filesystem.

• Key as PEM text format (Since 3.40.0).

• Empty

This can be defined as an absolute path on the local filesystem to the X.509 private key file used by this component.

File content should be encoded in the Privacy-Enhanced Mail (PEM) format.

When the value is defined as PEM text, the configuration will look as in the following example:

ssl_key = -----BEGIN RSA PRIVATE KEY-----
    MIICXgIBAAKBgQDOoZUYd8KMYbre5zZIwR+V6dO2+cCYVS46BHbRbqt7gczkoIWh
    ...
    MORE KEY DATA
    ...
    Wh+QF3UArO8r8RYv3HRcnBjrGh+yEK93wIifVNGgy63FIQ==
    -----END RSA PRIVATE KEY-----

If ssl_certificate is not defined, any value defined for this ssl_key configuration is ignored and the global ssl_key value is used.

If the value defined in ssl_certificate option already contains the private key, this option can be omitted by leaving it empty.

Empty

• Password as plain text.

• Empty

This is used to define the password of the private key, when the private X.509 key is stored as an encrypted file.

Leave it empty to not use a password for the private key file.

Empty

• Absolute path on the local file.

• Content of the CA chain (Since 3.40.0).

• ${LETS_ENCRYPT_X3_CA}

• ${MICROSOFT_IT_CA}

• ${GO_DADDY_G2_G1}

• Empty

This can be defined as an absolute path on the local filesystem to a file containing the certificates of the Certificate Authorities used to validate the remote peer.

This is used only for certificate-based peer validation. To add the CA certificate for an SSL certificate for this component, simply add it to ssl_certificate, possibly together with other certificates needed to complete the full chain of certificates.

The remote peer identity can only be validated when the remote address is configured using a fully qualified domain name. IP based validation will always fail, this is not a method accepted by the public certificate authorities.

You can define the content of the CA as text in PEM format.

When the value is defined as PEM text, the configuration will look as in the following example:

ssl_certificate_authority = -----BEGIN CERTIFICATE-----
    MIICaDCCAdGgAwIBAgIBDjANBgkqhkiG9w0BAQUFADBGMQswCQYDVQQGEwJHQjEP
    ...
    MORE CERTIFICATE DATA
    ...
    JZQaMjV9XxNTFOlNUTWswff3uE677wSVDPSuNkxo2FLRcGfPUxAQGsgL5Ts=
    -----END CERTIFICATE-----

When a certificate authority is defined, this will result in initiating the two-way SSL/TLS authentication/handshake validation. For a successful connection, make sure the remote peer sends a valid certificate. If the connection fails, the event with ID 40009 is emitted.

The certificate authority file should be stored as a file in PEM format. For multiple CA, place all certificates in the same file.

A series of bundle CA are distributed with SFTPPlus. They can be configured together and mixed with other CA certificates. The bundle CAs are available under the following names:

• ${LETS_ENCRYPT_X3_CA} - For Let's Encrypt X3 certificate authority.

• ${MICROSOFT_IT_CA} - For all Microsoft IT CA certificates, used by SharePoint Online and other services provided by Microsoft.

• ${GO_DADDY_G2_G1} - For all GoDaddy Certificate Bundles, G2 With Cross to G1.

To configure a component to accept the remote peer certificates signed by Microsoft IT CA, which is the CA used by SharePoint Online, you can set the configuration as:

ssl_certificate_authority = ${MICROSOFT_IT_CRL}

This defines the path on the local filesystem to a file containing the certificate in PEM format for the single certificate authority or multiple authorities authorities with which this component will communicate.

Only peer connections using certificates signed by one of these certificate authorities will be permitted to communicate to this component.

When this component should communicate with peers holding certificates issued by multiple certificate authorities, put each CA certificate in PEM format inside a single file.

Leave it empty to disable checking the issuer of the peer's certificates.

When certificate authority check is disabled, connection peers are not required to send a certificate. If the peer sends a certificate, it is ignored.

Empty

• Comma separated list of CRL paths or HTTP URLs.

• crl-distribution-points

• ${MICROSOFT_IT_CRL}

• Empty

It defines the locations from where one or more CRLs will be loaded.

Multiple CRLs are defined as a comma separated list.

It supports local files with absolute paths, in either of the following formats:

• file:///unix/absolute/test-ca.crl

• file://c:\\windows\\absolute\\test-ca.crl

Retrieving the CRL over HTTP is also supported. The HTTP request is done using non-persistent HTTP/1.1 connections. The URL will look as follows:

• http://example.com/some.crl

CRL distribution points (CDP) are supported by using the crl-distribution-points configuration value.

When CRL distribution points are configured, the local certificate defined at ssl_certificate needs to have the CDP extension. The CDP advertised in the local certificate is loaded at startup in order to validate the configuration.

The distribution points configuration is mutually exclusive with local file or HTTP url configurations. When the certificate revocation list is configured to use CDP, all other configured CRL location are ignored.

Leave it empty to disable certificate revocation checks.

The certificate revocation list can only be used when the component is configured with CA certificates stored in a single file in PEM format.

When multiple or chained CA certificates are configured the CRL is only checked for the peer's certificate and not for the CA certificate or for an intermediate CA.

The CRL file should be stored in PEM or DER format.

0

• Number of seconds

• 0

This defined the number of seconds after which a configured CRL is reloaded by this component.

When set to 0, the CRL file is initially loaded at startup and then loaded again after the Next Update field advertised in the CRL.

If the Next Publish extension is present in the CRL and this option is set to 0, the CRL will be loaded again at the date and time specified in the Next Publish extension.

If the CRL does not advertise the Next Update field you will have to configure a number of seconds after which the CRL should be reloaded, otherwise you will get a configuration error.

For example, a value of 86400 means that the CRL will be re-read after one day.

For more details about the CRL reloading see the documentation for CRL reloading rules

secure

• List of SSL/TLS ciphers in OpenSSL format.

• secure

This defined the list of ciphers accepted by this component while communicating over the network.

The special keyword secure contains all the algorithms that we currently consider secure.

Connections are closed if the remote peer has no common cipher in its list of configured ciphers.

When left empty, it will default to the secure configuration.

More information about the accepted values can be found at the cryptography guide

The format for this value is the same as the one used for defining the OpenSSL cipher list. More information can be found on the OpenSSL site.

secure

• secure

• all

• tlsv1.0

• tlsv1.1

• tlsv1.2

• tlsv1.3

This defines the comma-separated list of SSL and TLS methods that are accepted by this component during the secure communication handshake.

Set this to secure to allow only the TLS methods that are currently considered secure. For now, this is TLS 1.2 and TLS 1.3 but this might be changed in the future. Any other configured value is ignored.

Set this to all to allow any supported SSL or TLS method. Any other configured value is ignored.

Currently, the following methods are officially supported:

• tlsv1 or tlsv1.0, which is TLS 1.0.

• tlsv1.1, which is TLS 1.1.

• tlsv1.2, which is TLS 1.2.

• tlsv1.3, which is TLS 1.3.

[services/681f5f5d-0502-4ebb-90d5-5d5c549fac6b]
ssl_cipher_list = RC4-SHA

Support for SSLv3 will be removed in future versions.

SSLv2 is no longer supported since it is not secure.

In version 2.8.0, the following new methods were added: tlsv1.0 (alias for tlsv1), tlsv1.1 and tlsv1.2

Support for tlsv1.3 was added in version 3.47.0.

Prior to version 4.17.0, this was configured as a space separated value.

Empty

3.13.0

This option specifies whether the security of the FTPS command connection should be downgraded to plain text after authentication.

Leave it empty to keep the command connection secure.

When this option is enabled, the SSL/TLS layer is shutdown after authenticating. The rest of the control channel communication will be done over an unencrypted connection.

For more details about using this configuration option please check the dedicated documentation for the FTPS CCC modes.

Empty

• Host name or IP address of the FTP server.

Address of the server. IP or host name.

In order to check the identity of the remote server the address should be provided as FQDN. IP addresses are not supported by the server identity validation process.

Empty

3.13.0

This option specifies the password used to connect to the server.

It is defined in plain text format and sent over the network protected by the TLS protocol.

Empty

• Fully qualified domain name (FQDN)

• Comma separated list of fully qualified domain names

• Empty

Empty

• Absolute path on the local filesystem.

• Certificate in PEM text format (Since 3.40.0).

• Certificate in PKCS12 / PXF binary format (Since 4.0.0).

• Empty

None

Empty

• Absolute path on the local filesystem.

• Key as PEM text format (Since 3.40.0).

• Empty

This can be defined as an absolute path on the local filesystem to the X.509 private key file used by this component.

File content should be encoded in the Privacy-Enhanced Mail (PEM) format.

When the value is defined as PEM text, the configuration will look as in the following example:

ssl_key = -----BEGIN RSA PRIVATE KEY-----
    MIICXgIBAAKBgQDOoZUYd8KMYbre5zZIwR+V6dO2+cCYVS46BHbRbqt7gczkoIWh
    ...
    MORE KEY DATA
    ...
    Wh+QF3UArO8r8RYv3HRcnBjrGh+yEK93wIifVNGgy63FIQ==
    -----END RSA PRIVATE KEY-----

If ssl_certificate is not defined, any value defined for this ssl_key configuration is ignored and the global ssl_key value is used.

If the value defined in ssl_certificate option already contains the private key, this option can be omitted by leaving it empty.

Empty

• Password as plain text.

• Empty

This is used to define the password of the private key, when the private X.509 key is stored as an encrypted file.

Leave it empty to not use a password for the private key file.

Empty

• Absolute path on the local file.

• Content of the CA chain (Since 3.40.0).

• ${LETS_ENCRYPT_X3_CA}

• ${MICROSOFT_IT_CA}

• ${GO_DADDY_G2_G1}

• Empty

This can be defined as an absolute path on the local filesystem to a file containing the certificates of the Certificate Authorities used to validate the remote peer.

This is used only for certificate-based peer validation. To add the CA certificate for an SSL certificate for this component, simply add it to ssl_certificate, possibly together with other certificates needed to complete the full chain of certificates.

The remote peer identity can only be validated when the remote address is configured using a fully qualified domain name. IP based validation will always fail, this is not a method accepted by the public certificate authorities.

You can define the content of the CA as text in PEM format.

When the value is defined as PEM text, the configuration will look as in the following example:

ssl_certificate_authority = -----BEGIN CERTIFICATE-----
    MIICaDCCAdGgAwIBAgIBDjANBgkqhkiG9w0BAQUFADBGMQswCQYDVQQGEwJHQjEP
    ...
    MORE CERTIFICATE DATA
    ...
    JZQaMjV9XxNTFOlNUTWswff3uE677wSVDPSuNkxo2FLRcGfPUxAQGsgL5Ts=
    -----END CERTIFICATE-----

When a certificate authority is defined, this will result in initiating the two-way SSL/TLS authentication/handshake validation. For a successful connection, make sure the remote peer sends a valid certificate. If the connection fails, the event with ID 40009 is emitted.

The certificate authority file should be stored as a file in PEM format. For multiple CA, place all certificates in the same file.

A series of bundle CA are distributed with SFTPPlus. They can be configured together and mixed with other CA certificates. The bundle CAs are available under the following names:

• ${LETS_ENCRYPT_X3_CA} - For Let's Encrypt X3 certificate authority.

• ${MICROSOFT_IT_CA} - For all Microsoft IT CA certificates, used by SharePoint Online and other services provided by Microsoft.

• ${GO_DADDY_G2_G1} - For all GoDaddy Certificate Bundles, G2 With Cross to G1.

To configure a component to accept the remote peer certificates signed by Microsoft IT CA, which is the CA used by SharePoint Online, you can set the configuration as:

ssl_certificate_authority = ${MICROSOFT_IT_CRL}

This defines the path on the local filesystem to a file containing the certificate in PEM format for the single certificate authority or multiple authorities authorities with which this component will communicate.

Only peer connections using certificates signed by one of these certificate authorities will be permitted to communicate to this component.

When this component should communicate with peers holding certificates issued by multiple certificate authorities, put each CA certificate in PEM format inside a single file.

Leave it empty to disable checking the issuer of the peer's certificates.

When certificate authority check is disabled, connection peers are not required to send a certificate. If the peer sends a certificate, it is ignored.

Empty

• Comma separated list of CRL paths or HTTP URLs.

• crl-distribution-points

• ${MICROSOFT_IT_CRL}

• Empty

It defines the locations from where one or more CRLs will be loaded.

Multiple CRLs are defined as a comma separated list.

It supports local files with absolute paths, in either of the following formats:

• file:///unix/absolute/test-ca.crl

• file://c:\\windows\\absolute\\test-ca.crl

Retrieving the CRL over HTTP is also supported. The HTTP request is done using non-persistent HTTP/1.1 connections. The URL will look as follows:

• http://example.com/some.crl

CRL distribution points (CDP) are supported by using the crl-distribution-points configuration value.

When CRL distribution points are configured, the local certificate defined at ssl_certificate needs to have the CDP extension. The CDP advertised in the local certificate is loaded at startup in order to validate the configuration.

The distribution points configuration is mutually exclusive with local file or HTTP url configurations. When the certificate revocation list is configured to use CDP, all other configured CRL location are ignored.

Leave it empty to disable certificate revocation checks.

The certificate revocation list can only be used when the component is configured with CA certificates stored in a single file in PEM format.

When multiple or chained CA certificates are configured the CRL is only checked for the peer's certificate and not for the CA certificate or for an intermediate CA.

The CRL file should be stored in PEM or DER format.

0

• Number of seconds

• 0

This defined the number of seconds after which a configured CRL is reloaded by this component.

When set to 0, the CRL file is initially loaded at startup and then loaded again after the Next Update field advertised in the CRL.

If the Next Publish extension is present in the CRL and this option is set to 0, the CRL will be loaded again at the date and time specified in the Next Publish extension.

If the CRL does not advertise the Next Update field you will have to configure a number of seconds after which the CRL should be reloaded, otherwise you will get a configuration error.

For example, a value of 86400 means that the CRL will be re-read after one day.

For more details about the CRL reloading see the documentation for CRL reloading rules

secure

• List of SSL/TLS ciphers in OpenSSL format.

• secure

This defined the list of ciphers accepted by this component while communicating over the network.

The special keyword secure contains all the algorithms that we currently consider secure.

Connections are closed if the remote peer has no common cipher in its list of configured ciphers.

When left empty, it will default to the secure configuration.

More information about the accepted values can be found at the cryptography guide

The format for this value is the same as the one used for defining the OpenSSL cipher list. More information can be found on the OpenSSL site.

secure

• secure

• all

• tlsv1.0

• tlsv1.1

• tlsv1.2

• tlsv1.3

This defines the comma-separated list of SSL and TLS methods that are accepted by this component during the secure communication handshake.

Set this to secure to allow only the TLS methods that are currently considered secure. For now, this is TLS 1.2 and TLS 1.3 but this might be changed in the future. Any other configured value is ignored.

Set this to all to allow any supported SSL or TLS method. Any other configured value is ignored.

Currently, the following methods are officially supported:

• tlsv1 or tlsv1.0, which is TLS 1.0.

• tlsv1.1, which is TLS 1.1.

• tlsv1.2, which is TLS 1.2.

• tlsv1.3, which is TLS 1.3.

[services/681f5f5d-0502-4ebb-90d5-5d5c549fac6b]
ssl_cipher_list = RC4-SHA

Support for SSLv3 will be removed in future versions.

SSLv2 is no longer supported since it is not secure.

In version 2.8.0, the following new methods were added: tlsv1.0 (alias for tlsv1), tlsv1.1 and tlsv1.2

Support for tlsv1.3 was added in version 3.47.0.

Prior to version 4.17.0, this was configured as a space separated value.

Empty

• URL

Full URL address of the WebDAV server root page.

For SharePoint Online you can define it as:

url = https://YOUR-SITE.sharepoint.com

For generic WebDAV servers you can define it as:

url = https://files.example.com
or
url = https://files.example.com/path/webdav/resource

Or if you need a custom port number use:

url = https://files.example.com/path/webdav/resource

When this is defined as an http:// URL, the SSL configuration options are ignored.

Empty

3.0.0

This option specifies the password used to connect to the WebDAV server.

It is defined in plain text format and sent over the network protected by the HTTPS connection.

Empty

• URI like expression.

• connect://12.342.421.2:3128

This configuration adds the proxy used to connect to the final URL.

For now, only the HTTP/1.1 CONNECT tunneling proxy method is supported.

Leave it empty to not use a proxy.

'sharepoint-online'

• sharepoint-online

• basic-authentication-scheme

The authentication method to use for connecting to the WebDAV server.

The default value of sharepoint-online is used for the Microsoft SharePoint Online cloud service authenticated via the Microsoft single sign-on process.

Another supported method is basic-authentication-scheme, the HTTP "Basic" access authentication, as per RFC 7617.

'No'

• Yes

• No

When set to Yes, the WebDAV connection is made via insecure HTTP instead of HTTPS.

Empty

• Fully qualified domain name (FQDN)

• Comma separated list of fully qualified domain names

• Empty

Empty

• Absolute path on the local filesystem.

• Certificate in PEM text format (Since 3.40.0).

• Certificate in PKCS12 / PXF binary format (Since 4.0.0).

• Empty

None

Empty

• Absolute path on the local filesystem.

• Key as PEM text format (Since 3.40.0).

• Empty

This can be defined as an absolute path on the local filesystem to the X.509 private key file used by this component.

File content should be encoded in the Privacy-Enhanced Mail (PEM) format.

When the value is defined as PEM text, the configuration will look as in the following example:

ssl_key = -----BEGIN RSA PRIVATE KEY-----
    MIICXgIBAAKBgQDOoZUYd8KMYbre5zZIwR+V6dO2+cCYVS46BHbRbqt7gczkoIWh
    ...
    MORE KEY DATA
    ...
    Wh+QF3UArO8r8RYv3HRcnBjrGh+yEK93wIifVNGgy63FIQ==
    -----END RSA PRIVATE KEY-----

If ssl_certificate is not defined, any value defined for this ssl_key configuration is ignored and the global ssl_key value is used.

If the value defined in ssl_certificate option already contains the private key, this option can be omitted by leaving it empty.

Empty

• Password as plain text.

• Empty

This is used to define the password of the private key, when the private X.509 key is stored as an encrypted file.

Leave it empty to not use a password for the private key file.

Empty

• Absolute path on the local file.

• Content of the CA chain (Since 3.40.0).

• ${LETS_ENCRYPT_X3_CA}

• ${MICROSOFT_IT_CA}

• ${GO_DADDY_G2_G1}

• Empty

This can be defined as an absolute path on the local filesystem to a file containing the certificates of the Certificate Authorities used to validate the remote peer.

This is used only for certificate-based peer validation. To add the CA certificate for an SSL certificate for this component, simply add it to ssl_certificate, possibly together with other certificates needed to complete the full chain of certificates.

The remote peer identity can only be validated when the remote address is configured using a fully qualified domain name. IP based validation will always fail, this is not a method accepted by the public certificate authorities.

You can define the content of the CA as text in PEM format.

When the value is defined as PEM text, the configuration will look as in the following example:

ssl_certificate_authority = -----BEGIN CERTIFICATE-----
    MIICaDCCAdGgAwIBAgIBDjANBgkqhkiG9w0BAQUFADBGMQswCQYDVQQGEwJHQjEP
    ...
    MORE CERTIFICATE DATA
    ...
    JZQaMjV9XxNTFOlNUTWswff3uE677wSVDPSuNkxo2FLRcGfPUxAQGsgL5Ts=
    -----END CERTIFICATE-----

When a certificate authority is defined, this will result in initiating the two-way SSL/TLS authentication/handshake validation. For a successful connection, make sure the remote peer sends a valid certificate. If the connection fails, the event with ID 40009 is emitted.

The certificate authority file should be stored as a file in PEM format. For multiple CA, place all certificates in the same file.

A series of bundle CA are distributed with SFTPPlus. They can be configured together and mixed with other CA certificates. The bundle CAs are available under the following names:

• ${LETS_ENCRYPT_X3_CA} - For Let's Encrypt X3 certificate authority.

• ${MICROSOFT_IT_CA} - For all Microsoft IT CA certificates, used by SharePoint Online and other services provided by Microsoft.

• ${GO_DADDY_G2_G1} - For all GoDaddy Certificate Bundles, G2 With Cross to G1.

To configure a component to accept the remote peer certificates signed by Microsoft IT CA, which is the CA used by SharePoint Online, you can set the configuration as:

ssl_certificate_authority = ${MICROSOFT_IT_CRL}

This defines the path on the local filesystem to a file containing the certificate in PEM format for the single certificate authority or multiple authorities authorities with which this component will communicate.

Only peer connections using certificates signed by one of these certificate authorities will be permitted to communicate to this component.

When this component should communicate with peers holding certificates issued by multiple certificate authorities, put each CA certificate in PEM format inside a single file.

Leave it empty to disable checking the issuer of the peer's certificates.

When certificate authority check is disabled, connection peers are not required to send a certificate. If the peer sends a certificate, it is ignored.

Empty

• Comma separated list of CRL paths or HTTP URLs.

• crl-distribution-points

• ${MICROSOFT_IT_CRL}

• Empty

It defines the locations from where one or more CRLs will be loaded.

Multiple CRLs are defined as a comma separated list.

It supports local files with absolute paths, in either of the following formats:

• file:///unix/absolute/test-ca.crl

• file://c:\\windows\\absolute\\test-ca.crl

Retrieving the CRL over HTTP is also supported. The HTTP request is done using non-persistent HTTP/1.1 connections. The URL will look as follows:

• http://example.com/some.crl

CRL distribution points (CDP) are supported by using the crl-distribution-points configuration value.

When CRL distribution points are configured, the local certificate defined at ssl_certificate needs to have the CDP extension. The CDP advertised in the local certificate is loaded at startup in order to validate the configuration.

The distribution points configuration is mutually exclusive with local file or HTTP url configurations. When the certificate revocation list is configured to use CDP, all other configured CRL location are ignored.

Leave it empty to disable certificate revocation checks.

The certificate revocation list can only be used when the component is configured with CA certificates stored in a single file in PEM format.

When multiple or chained CA certificates are configured the CRL is only checked for the peer's certificate and not for the CA certificate or for an intermediate CA.

The CRL file should be stored in PEM or DER format.

0

• Number of seconds

• 0

This defined the number of seconds after which a configured CRL is reloaded by this component.

When set to 0, the CRL file is initially loaded at startup and then loaded again after the Next Update field advertised in the CRL.

If the Next Publish extension is present in the CRL and this option is set to 0, the CRL will be loaded again at the date and time specified in the Next Publish extension.

If the CRL does not advertise the Next Update field you will have to configure a number of seconds after which the CRL should be reloaded, otherwise you will get a configuration error.

For example, a value of 86400 means that the CRL will be re-read after one day.

For more details about the CRL reloading see the documentation for CRL reloading rules

secure

• List of SSL/TLS ciphers in OpenSSL format.

• secure

This defined the list of ciphers accepted by this component while communicating over the network.

The special keyword secure contains all the algorithms that we currently consider secure.

Connections are closed if the remote peer has no common cipher in its list of configured ciphers.

When left empty, it will default to the secure configuration.

More information about the accepted values can be found at the cryptography guide

The format for this value is the same as the one used for defining the OpenSSL cipher list. More information can be found on the OpenSSL site.

secure

• secure

• all

• tlsv1.0

• tlsv1.1

• tlsv1.2

• tlsv1.3

This defines the comma-separated list of SSL and TLS methods that are accepted by this component during the secure communication handshake.

Set this to secure to allow only the TLS methods that are currently considered secure. For now, this is TLS 1.2 and TLS 1.3 but this might be changed in the future. Any other configured value is ignored.

Set this to all to allow any supported SSL or TLS method. Any other configured value is ignored.

Currently, the following methods are officially supported:

• tlsv1 or tlsv1.0, which is TLS 1.0.

• tlsv1.1, which is TLS 1.1.

• tlsv1.2, which is TLS 1.2.

• tlsv1.3, which is TLS 1.3.

[services/681f5f5d-0502-4ebb-90d5-5d5c549fac6b]
ssl_cipher_list = RC4-SHA

Support for SSLv3 will be removed in future versions.

SSLv2 is no longer supported since it is not secure.

In version 2.8.0, the following new methods were added: tlsv1.0 (alias for tlsv1), tlsv1.1 and tlsv1.2

Support for tlsv1.3 was added in version 3.47.0.

Prior to version 4.17.0, this was configured as a space separated value.

Empty

• .

Receiving URL for your partner.

SFTPPlus will use this URL to send files to your AS2 partner.

When this is defined as an http:// URL, the SSL configuration options are ignored.

Empty

4.5.0

Username used to authenticate to the remote AS2 partner server.

Leave it empty when the remote AS2 partner doesn't require authentication.

Empty

4.5.0

This option specifies the password used to connect to the remote AS2 partner server.

It is ignored when username is empty.

'General server SSL certificate'

4.5.0

Certificate for your own local AS2 organization used when signing files sent to a remote AS2 partner.

The certificate should be configured in PEM format.

This configuration can also contain the private key associated to the certificate.

This can be empty when sending unsigned files.

'General server SSL private key'

4.5.0

Certificate for your own local AS2 organization used when signing files sent to a remote AS2 partner.

The certificate should be configured in PEM format.

This configuration can also contain the private key associated to the certificate.

Empty

4.5.0

Certificate in PEM format used to encrypt files sent to the AS2 partner and to validate the received signed MDN.

You can define multiple PEM certificates for the case in which the partner uses different certificates for signing and encryption.

Old and new PEM certificates can be defined at the same time for a partner's certificate rollover.

When sending encrypted files, the first configured PEM certificate will be used for the encryption operation.

'signed-and-encrypted'

4.5.0

This defines the method used to secure the file transfers on top of the standard security provided by the HTTPS protocol.

When encrypting file content, the first certificate defined at as2_partner_certificates is used.

When signing file content, the digest/hashing algorithm defined in as2_signature_algorithm is used.

When defined as disabled, files are sent unsigned and unencrypted.

'sync-signed'

4.5.0

This defines the method used to request the message disposition notifications (MDN) receipt.

When requesting a signed MDN, it will make the request using the digest/hashing algorithm defined in as2_signature_algorithm.

When defined as disabled, it will not request an MDN receipt.

'aes256'

4.5.0

Symmetric encryption algorithm used to encrypt sent files.

All algorithms use the Cipher Block Chaining (CBC) mode and PKCS#1 v1.5 padding.

Empty

• Fully qualified domain name (FQDN)

• Comma separated list of fully qualified domain names

• Empty

Empty

• Absolute path on the local filesystem.

• Certificate in PEM text format (Since 3.40.0).

• Certificate in PKCS12 / PXF binary format (Since 4.0.0).

• Empty

None

Empty

• Absolute path on the local filesystem.

• Key as PEM text format (Since 3.40.0).

• Empty

This can be defined as an absolute path on the local filesystem to the X.509 private key file used by this component.

File content should be encoded in the Privacy-Enhanced Mail (PEM) format.

When the value is defined as PEM text, the configuration will look as in the following example:

ssl_key = -----BEGIN RSA PRIVATE KEY-----
    MIICXgIBAAKBgQDOoZUYd8KMYbre5zZIwR+V6dO2+cCYVS46BHbRbqt7gczkoIWh
    ...
    MORE KEY DATA
    ...
    Wh+QF3UArO8r8RYv3HRcnBjrGh+yEK93wIifVNGgy63FIQ==
    -----END RSA PRIVATE KEY-----

If ssl_certificate is not defined, any value defined for this ssl_key configuration is ignored and the global ssl_key value is used.

If the value defined in ssl_certificate option already contains the private key, this option can be omitted by leaving it empty.

Empty

• Password as plain text.

• Empty

This is used to define the password of the private key, when the private X.509 key is stored as an encrypted file.

Leave it empty to not use a password for the private key file.

Empty

• Absolute path on the local file.

• Content of the CA chain (Since 3.40.0).

• ${LETS_ENCRYPT_X3_CA}

• ${MICROSOFT_IT_CA}

• ${GO_DADDY_G2_G1}

• Empty

This can be defined as an absolute path on the local filesystem to a file containing the certificates of the Certificate Authorities used to validate the remote peer.

This is used only for certificate-based peer validation. To add the CA certificate for an SSL certificate for this component, simply add it to ssl_certificate, possibly together with other certificates needed to complete the full chain of certificates.

The remote peer identity can only be validated when the remote address is configured using a fully qualified domain name. IP based validation will always fail, this is not a method accepted by the public certificate authorities.

You can define the content of the CA as text in PEM format.

When the value is defined as PEM text, the configuration will look as in the following example:

ssl_certificate_authority = -----BEGIN CERTIFICATE-----
    MIICaDCCAdGgAwIBAgIBDjANBgkqhkiG9w0BAQUFADBGMQswCQYDVQQGEwJHQjEP
    ...
    MORE CERTIFICATE DATA
    ...
    JZQaMjV9XxNTFOlNUTWswff3uE677wSVDPSuNkxo2FLRcGfPUxAQGsgL5Ts=
    -----END CERTIFICATE-----

When a certificate authority is defined, this will result in initiating the two-way SSL/TLS authentication/handshake validation. For a successful connection, make sure the remote peer sends a valid certificate. If the connection fails, the event with ID 40009 is emitted.

The certificate authority file should be stored as a file in PEM format. For multiple CA, place all certificates in the same file.

A series of bundle CA are distributed with SFTPPlus. They can be configured together and mixed with other CA certificates. The bundle CAs are available under the following names:

• ${LETS_ENCRYPT_X3_CA} - For Let's Encrypt X3 certificate authority.

• ${MICROSOFT_IT_CA} - For all Microsoft IT CA certificates, used by SharePoint Online and other services provided by Microsoft.

• ${GO_DADDY_G2_G1} - For all GoDaddy Certificate Bundles, G2 With Cross to G1.

To configure a component to accept the remote peer certificates signed by Microsoft IT CA, which is the CA used by SharePoint Online, you can set the configuration as:

ssl_certificate_authority = ${MICROSOFT_IT_CRL}

This defines the path on the local filesystem to a file containing the certificate in PEM format for the single certificate authority or multiple authorities authorities with which this component will communicate.

Only peer connections using certificates signed by one of these certificate authorities will be permitted to communicate to this component.

When this component should communicate with peers holding certificates issued by multiple certificate authorities, put each CA certificate in PEM format inside a single file.

Leave it empty to disable checking the issuer of the peer's certificates.

When certificate authority check is disabled, connection peers are not required to send a certificate. If the peer sends a certificate, it is ignored.

Empty

• Comma separated list of CRL paths or HTTP URLs.

• crl-distribution-points

• ${MICROSOFT_IT_CRL}

• Empty

It defines the locations from where one or more CRLs will be loaded.

Multiple CRLs are defined as a comma separated list.

It supports local files with absolute paths, in either of the following formats:

• file:///unix/absolute/test-ca.crl

• file://c:\\windows\\absolute\\test-ca.crl

Retrieving the CRL over HTTP is also supported. The HTTP request is done using non-persistent HTTP/1.1 connections. The URL will look as follows:

• http://example.com/some.crl

CRL distribution points (CDP) are supported by using the crl-distribution-points configuration value.

When CRL distribution points are configured, the local certificate defined at ssl_certificate needs to have the CDP extension. The CDP advertised in the local certificate is loaded at startup in order to validate the configuration.

The distribution points configuration is mutually exclusive with local file or HTTP url configurations. When the certificate revocation list is configured to use CDP, all other configured CRL location are ignored.

Leave it empty to disable certificate revocation checks.

The certificate revocation list can only be used when the component is configured with CA certificates stored in a single file in PEM format.

When multiple or chained CA certificates are configured the CRL is only checked for the peer's certificate and not for the CA certificate or for an intermediate CA.

The CRL file should be stored in PEM or DER format.

0

• Number of seconds

• 0

This defined the number of seconds after which a configured CRL is reloaded by this component.

When set to 0, the CRL file is initially loaded at startup and then loaded again after the Next Update field advertised in the CRL.

If the Next Publish extension is present in the CRL and this option is set to 0, the CRL will be loaded again at the date and time specified in the Next Publish extension.

If the CRL does not advertise the Next Update field you will have to configure a number of seconds after which the CRL should be reloaded, otherwise you will get a configuration error.

For example, a value of 86400 means that the CRL will be re-read after one day.

For more details about the CRL reloading see the documentation for CRL reloading rules

secure

• List of SSL/TLS ciphers in OpenSSL format.

• secure

This defined the list of ciphers accepted by this component while communicating over the network.

The special keyword secure contains all the algorithms that we currently consider secure.

Connections are closed if the remote peer has no common cipher in its list of configured ciphers.

When left empty, it will default to the secure configuration.

More information about the accepted values can be found at the cryptography guide

The format for this value is the same as the one used for defining the OpenSSL cipher list. More information can be found on the OpenSSL site.

secure

• secure

• all

• tlsv1.0

• tlsv1.1

• tlsv1.2

• tlsv1.3

This defines the comma-separated list of SSL and TLS methods that are accepted by this component during the secure communication handshake.

Set this to secure to allow only the TLS methods that are currently considered secure. For now, this is TLS 1.2 and TLS 1.3 but this might be changed in the future. Any other configured value is ignored.

Set this to all to allow any supported SSL or TLS method. Any other configured value is ignored.

Currently, the following methods are officially supported:

• tlsv1 or tlsv1.0, which is TLS 1.0.

• tlsv1.1, which is TLS 1.1.

• tlsv1.2, which is TLS 1.2.

• tlsv1.3, which is TLS 1.3.

[services/681f5f5d-0502-4ebb-90d5-5d5c549fac6b]
ssl_cipher_list = RC4-SHA

Support for SSLv3 will be removed in future versions.

SSLv2 is no longer supported since it is not secure.

In version 2.8.0, the following new methods were added: tlsv1.0 (alias for tlsv1), tlsv1.1 and tlsv1.2

Support for tlsv1.3 was added in version 3.47.0.

Prior to version 4.17.0, this was configured as a space separated value.

Empty

3.36.0

Any of the two access keys for the Azure storage account.

It should be specified in Base64 format. This is the default format presented by the Azure Portal.

Empty

• Host name or IP address of the server.

Address of the remote SSH server. IP or DNS name.

If you are using Azure Files the address will have the following format: ACCOUNT_NAME.file.core.windows.net where ACCOUNT_NAME is replaced with your Azure Storage account name.

Empty

4.13.0

Username or storage account name used to authenticate to the remote server.

Anonymous (guest) access is not yet supported. Contact us if you need support for connecting to a Windows Share without a username and password.

'yes'

4.16.0

This option defines whether SFTPPlus requires SMB encryption when connecting to the remote share.

With modern servers it is recommended to keep this option set to yes to make use of the highest level of available security.

On Windows 2008 and Windows 7 or older version of Windows, SMB encryption is not supported. To connect to these shares you will need to set this configuration to no.