Creating SSL Certificates

A self-signed certificate contains a public key, information about the owner of the certificate, and the owner's signature. It has an associated private key, but it does not verify the origin of the certificate through a third-party certificate authority.

To achieve the highest level of authentication between critical software components, do not use self-signed certificates, or use them selectively.

A certificate on the client must be associated with EFT Server to initiate an SSL connection. When you are administering EFT Server on the local computer, you can create certificates using the Certificate Creation Wizard (Tools > Certificate Creation Wizard) or import your own. There are three types of files associated with an SSL certificate key pair:

• Private key file (.key) - The private key should never be distributed to anyone. It is used to decrypt the session, which is encrypted by the public key.

• Certificate signing request file (.csr) - Each time you create a certificate using EFT Server, a Certificate Signing Request file is also created. A Certificate Signing Request (CSR) is a PKCS10 request, which is an unsigned copy of your certificate. This file can be signed by EFT Server's Certificate Signing Utility or sent to an intermediate certificate authority, such as GeoTrust, for signing.

• Certificate file (.crt) - This is a signed certificate, whether self-signed or signed by an intermediate certificate authority.

For maximum compliance with security standards, you should use a trusted authority signed SSL certificate. You can import certificates or use this wizard to create your own. The private key (.key) and certificate request (.csr) files are created at the same time. You are prohibited from creating certificates for EFT Server while remotely administering EFT Server because this Action can create a security breach. Any certificates you create remain on the computer on which you create them, unless you take special steps to deliver and associate these files with another computer.

To create an SSL certificate

1. In the administration interface, connect to EFT Server, click the Server tab, then do one of the following:

   • On the main menu, click Tools > Create SSL Certificate.

   • On the toolbar, click the New SSL Certificate icon .

   • On the keyboard, press ALT+T+C.

   The Create SSL Certificate wizard appears.

   

2. In the Certificate name box, specify the name (up to 256 characters) of the certificate that will be generated.

3. In the Path box, specify the path to the folder in which the certificate is to be saved. The wizard saves the .key, .csr, and .crt files in this folder.

   If you are purchasing a signed certificate from a certificate authority (CA), you usually need to forward the contents to the CA. To do this, locate the .csr and open it in a text editor; then you can copy and paste the contents.

4. In the Expiration Date box, specify the date on which the certificate will expire.

5. In the Passphrase and Confirm passphrase boxes, type the passphrase used to encrypt the private key. The passphrase can be any combination of characters or spaces. Do not lose the passphrase; the certificate is useless without it.

6. In the Key Length (in bits) box, specify the key length: 512, 1024, 2048, and 4096 bits. Smaller keys are faster, larger keys are more secure.

   If you create a certificate with a key length of 4096 bits or greater, the Web Transfer Client will not function properly due to its reliance on the Java runtime (JRE), which currently does not support key lengths of 4096 bits or greater.

7. Click Next. The Certificate Information page appears.

   

   Each of the boxes must be completed before continuing. The information you provide is stored in the certificate.

8. In the City/Town box, provide the name of your city, town, or other locality.

9. In the State/Province box, provide the name of the state or province.

10. In Organization box, provide the name of your organization, or any other designator.

11. In the Common Name box, provide the common name or fully qualified domain name, such as www.globalscape.com. (Typically, the name or domain name associated with the Site.)

12. In the E-Mail box, provide your e-mail address in the format username@domain.com.

13. In the Unit box, type any other information about your organization, such as department name.

14. In the Country box, provide the 2-letter ISO country code using uppercase letters.

15. Click Next. The Certificate Options page appears.

    

16. If the Associate the certificate to the Site(s) specified below check box is cleared, the wizard saves only the certificate files in the folder you previously specified, but does not associate it with any Site. If the check box is selected, the wizard associates the certificate to the administration service or Site(s) you specify in the Apply certificate to box.

17. In the Apply certificate to box, specify which components of EFT Server are affected (Administration Service, All Sites, or a specific Site).

    Associating a new certificate with a Site requires a restart of the Site, and any active users will be disconnected, so it is recommended that you associate certificates when Sites are inactive or stopped.

18. If the Add this certificate to the Trusted Certificate list check box is selected, the wizard adds the certificate to the Trusted Certificates database. Use this feature if you are creating certificates for user distribution. You can limit EFT Server access to just the users that have the certificate. You can verify the addition to the Trusted Certificate database by clicking Tools > Certificate Manager or, on the toolbar, click the Certificate Manager icon . (Refer to The Certificate Manager for more information.)

19. In the Certificate Format box, specify the format of the certificate file (PEM (ASCII) encoded - *.crt (default), PKCS#7 (P7B public key) - *.pb7, DER (binary public key) - *.cer).

20. In the Private Key Format box, specify the format of the key file (PEM (ASCII) encoded - *.key (default), PKCS#12 (PFX combined) - *.pfx, DER (binary private key) - *.der).

21. Click Finish. The certificate is created and a message box appears. You can select and copy the certificate information, if desired, then click OK to dismiss the message.