PKI and X.509 Certificate Validation

SFTPPlus MFT uses public key infrastructure (PKI) and X.509 certificates to validate identities for TLS-protected file transfers. Administrators can configure trusted certificate authorities, certificate revocation lists, public key pinning, and trust on first use for different transfer partners and environments.

Standard TLS Certificate Validation ​

By default, SFTPPlus validates a remote TLS server by checking its certificate validity period, hostname, and chain of trust to a configured certificate authority. This is the preferred validation method for FTPS, HTTPS, AS2, and other TLS-protected connections.

SFTPPlus services can also validate X.509 client certificates against trusted certificate authorities. This allows certificates issued by an internal or public PKI to identify clients connecting to a protected service.

Certificate Revocation List Validation ​

A certificate authority can revoke an X.509 certificate before its expiry date, for example when its private key is lost or compromised. SFTPPlus can check certificate revocation lists (CRLs) so that a revoked certificate is no longer accepted.

SFTPPlus Web Manager TLS certificate authority and CRL configuration.
Configure trusted certificate authorities and revocation lists for TLS validation.

Administrators can load multiple CRLs from local files or HTTP locations. SFTPPlus refreshes them according to their published update schedule and records CRL loading and refresh operations in the audit log. When a required CRL cannot be refreshed, the protected service fails rather than continuing with stale revocation information.

Public Key Pinning for Legacy Servers ​

Some legacy servers use a certificate that cannot pass standard TLS validation because it has expired, does not match the server hostname, or was issued by an unavailable certificate authority. For these cases, SFTPPlus supports TLS public key pinning.

SFTPPlus Web Manager public key pinning configuration.
Configure public key pinning for a remote TLS server.

Administrators configure a fixed list of trusted server public keys, not certificates. SFTPPlus validates the identity of the remote TLS server by matching its public key. The certificate attributes, including its hostname, validity period, and certificate authority chain, are ignored. Configuring a pinned public key explicitly accepts that these certificate properties will not be validated. The public key should be verified through a separate trusted channel before it is pinned.

Remember a Certificate Authority on First Connection ​

SFTPPlus can automatically detect the remote server's certificate authority on the first connection and remember it for subsequent connections. This trust-on-first-use option is useful when a transfer partner cannot provide its certificate authority in advance.

The first connection should be made over a trusted network or verified through another trusted channel. SFTPPlus then uses the remembered authority to validate the server on future connections.