Help, configuration and tips.

What is SSL?
The Secure Socket Layer (SSL) is used to encrypt data as it is sent down a connection. This protects data from being intercepted for malicious use via what is referred to as a 'man in the middle' attack. With SSL, if any information is intercepted it will be useless without the relevant information needed to decrypt it. Therefore, when using SSL, you have a guarantee that the files you send and receive are always safe and secure.

Certificates
SSL also deals with authenticating both client and server by using certificates to validate their identity. This is especially important with FTP for preventing a 'masquerade' attack. This is where a third party can actually pretend to be your server in order to gain sensitive material or send harmful viruses to your users. SSL certificates ensure that the server you are connecting to, is the server that you intended to connect to.

Configuring SSL
When using SSL with Ability FTP Server, there are a few things that you need to understand in order to configure your server correctly. First of all, the server must have a default certificate set which the SSL connections will use. This is also used to validate the servers identity to clients. It is also important to realize that FTP uses two connections; one for commands and a separate connection for file transfers. Ability FTP Server supports two different modes for which SSL can be used, these are 'Explicit SSL' and 'Implicit SSL'.

Explicit SSL
Explicit SSL operates such that a connection to the server is made on the normal FTP port (default port 21). Communication initially starts in plain text until the client issues an 'AUTH SSL' or 'AUTH TLS' command, which then leads to certificate verification and a secure SSL connection being negotiated. If all goes well, then the server and client will proceed to send all further commands and replies encrypted using SSL.

Implicit SSL
This allows the server to specify a different port for SSL communication (default port 990). Any connections made to this port require immediate negotiation of certificates and SSL, avoiding any communication in plain text whatsoever.

Data Channel Encryption
The security standard for FTP states that the data channel remains insecure by default. This means that SSL encryption would usually only be enabled on the command channel. Although this would protect from eavesdropping of user names, passwords and file locations, the uploaded and downloaded files would remain vulnerable. By setting the data channel to be encrypted by default, the FTP client does not have to implicitly state encryption of the data channel. However, you must ensure that the FTP client is able to deal with an automatically encrypted data channel.

Certificates
On the Security tab of the settings dialog for Ability FTP Server, there is a button that will take you to the certificate management area. This area allows you to create and also import certificates to be used with the server's SSL communication. To use SSL, you must have at least one certificate installed in Ability FTP Server and you must also select one certificate as the default.

Creating Certificates
Creating new certificates is the simplest method of acquiring a certificate. Simply click 'Create' and fill in the necessary information. If you are unsure of any field, you can always press F1 on any open dialog to open the manual on the relevant page. All certificates require a private key and Ability FTP Server will either create a 1024 bit key or 2048 bit key depending on your selection. Larger private keys will provide stronger security on your connections and so a 2048 bit key is recommended. Once all fields are completed, simply click 'Create' again and your new certificate will be generated and ready to use.

Certificate Signing Requests (CSR)
When you create a new certificate using Ability FTP Server, three files related to that certificate are generated in the 'certs' folder (usually C:\Program Files\Code-Crafters\Ability FTP Server 2\certs). These include a private key ('.key') file, a certificate signing request ('.csr') and a self signed certificate ('.crt'). Normally, you use the self signed certificate and corresponding private key for SSL communication. However, if you want to have your certificates signed by a trusted certificate authority, such as Verisign, you will need to send them the certificate signing request ('.csr') file. They can then sign this and send you back a new certificate ('.crt' or '.cer') file. To use this new certificate you must import this back into Ability FTP Server using the original private key ('.key') and newly signed certificate ('.crt' or '.cer'). For more details on importing certificates please read the next section.

Importing Certificates
If you choose to import an existing certificate, you must have access to the certificate file and the relevant private key used to create it. These can be in a range of formats. Usually a private key is contained in a '.key' file and the certificate in either a .crt or .cer file. However, it is also common to produce a combined private key / certificate pair in a single file suffixed '.pem'. Ability FTP Server can take any known format of RSA base64 encoded private keys and certificates. It then loads in the pair and checks the integrity to ensure that they match each other. Once the pair have been successfully checked, they are copied to the 'certs' folder in the '.key' and '.crt' format for later use. If the files have different names (e.g. cert2.key / bobscert.crt) then the key is renamed to match the certificate (i.e. bobscert.key / bobscert.crt). You can also specify an entirely new name for both to be renamed to.