SFTPPlus MFT Release 6.2.1

SFTPPlus MFT version 6.2.1 is now available.

Trusted certificate authorities ​

The embedded Mozilla trusted certificate authority (CA) bundle has been updated to remove the root certificate that signed the compromised eMudhra intermediate certificates. The compromised private keys belong to intermediate CA certificates and could be used to forge certificates that impersonate HTTPS sites. See Mozilla's report on the compromised eMudhra intermediate certificates for details of the incident and the trust store update.

Source IP filtering and Web Manager ​

Source IP filters now accept country codes and autonomous system numbers (ASNs), which identify networks operated by internet providers and other organizations. Administrators can update the GeoIP database and inspect its entries using new administrative commands.

The Web Manager provides a guided table for source IP rules in accounts, groups, administrators, roles, security policies, and cluster pools. It validates rules before adding them and converts CIDR values to network addresses automatically. For example, a rule entered as 192.0.2.25/24 is stored as 192.0.2.0/24. Account, group, administrator, and role summaries display each source IP rule on a separate line. See our guide to source IP validation for individual users for how these rules apply to accounts and groups.

The Web Manager also provides separate fields for the login information link, title, and message. If a component fails to restart, its restart warning is cleared.

AS2 compatibility and audit records ​

AS2 transfers now archive received Message Disposition Notification (MDN) receipts alongside files in the success or failure archive, keeping the receipt with the transfer record. Receive audit logs identify both the trusted certificate used to verify a file signature and the private certificate used to decrypt a file by their vault identifiers. Certificate vault identifiers also change when a certificate is renewed with the same public key, so audit records can distinguish each certificate.

Several changes improve compatibility with AS2 partners. Successful responses consistently return HTTP 200, accommodating implementations that do not accept HTTP 201. MDN validation accepts double quotes around Message Integrity Check (MIC) algorithm names. Signed files are accepted when the requested receipt signature uses a different digest algorithm from the file signature. AS2 transfers also support sending empty files.

Concurrent AS2 uploads with the same filename no longer interfere with one another: the last upload to finish replaces the destination file. Transfers that require a private certificate are rejected with a clear server log message when no certificate is configured, instead of failing with an internal server error. Our AS2 file transfer guide explains how files, signatures, and receipts fit into a partner exchange.

HTTP authentication and text conversion ​

HTTP-pull locations now include configured headers in authentication requests. You can set a separate authentication path on the same server and choose the HTTP method when needed.

Transfers can convert UTF-16 and ISO-8859-15 text files to UTF-8 with a byte order mark (BOM). When converting text to UTF-16, transfers write the byte order mark only once, at the start of the destination file.

Customers can contact our support team to request a download link. To evaluate SFTPPlus MFT, request a trial.

For the complete list of changes, see the 6.2.1 release notes.