Certificate Selection

The Certificate Selection tab is used to choose which private key and certificate you want to use during SSL connection negotiations. If a new certificate has not been created, follow the directions for Certificate Creation. The certificate and key included in the installation should never be used for secure SSL connection.

To select an SSL Certificate:

  1. Click the Browse button next to the Private Key box to select the private key you want to use during SSL negotiation.

  2. Click the Browse button next to the Certificate box to select the certificate you want to use during SSL negotiation. The certificate you use must have been created using the key you selected for the Private Key box.

  3. Enter the pass phrase associated with that certificate in both the Pass Phrase and the Pass Phrase Confirmation boxes. A pass phrase can be any combination of words, symbols, or numbers. It is case sensitive and must be written exactly the same way each time it is used.

Without the correct pass phrase in both boxes, the certificate and private key cannot be verified and the selection can not be saved.

  4. Click Apply to save your entries.

Clicking the Reset button will erase what you have done since the last time new settings were applied.


Certificate Creation

To create an SSL certificate:

  1. From the Tools menu, select Configure SSL. The SSL Utilities window appears.

  2. Click the Certificate Creation tab.

  3. Enter a name in the Certificate Set Name box. This will be the name of the certificate that is generated by WS_FTP Server.

  4. Click the Browse button in the Output Location box to select the folder you want the certificate created in.

  5. Enter information in all of the Certificate Information boxes:

    City/Town. City or town where you are located. (Ex. Augusta)

    State/Province. State or Province where you are located. (Ex. Georgia)

    Organization. Company or individual user name.

    Common Name. This can be either the name of the person creating the certificate or the fully qualified domain name of the server associated with the host.

    Pass Phrase. Pass phrase that is to be used to encrypt the private key. It is important to remember this pass phrase. The pass phrase can be any combination of words, symbols, spaces, or numbers.

    Pass Phrase Confirmation. Re-enter the same pass phrase as above.

    Country. The country you are in. This must be a valid 2 letter country code. (Ex. US)

    Email. E-mail address of the person the certificate belongs to.

    Unit. Name of organizational unit. (Ex. Research and Development)

  6. After all of the boxes are filled in correctly, click Create to generate the keys, certificate, and certificate signing request. If all of the boxes are not filled in, you can not create the certificate.

If you are creating a certificate to be used by WS_FTP Pro, you should send the certificate signing request (by e-mail) to your server administrator. If they require it, they will sign the certificate and return it to you. The returned certificate should be the one you identify in the Certificate Selection tab.


Certificate Signing

The Certificate Signing tab is used to sign requests with the private key and certificate you define. When a user wants to make an SSL connection with a host they have an account on, the user creates a certificate of their own and sends the generated request file to the server administrator. This is usually done through e-mail. Once the administrator has the file, they can sign the request and create a new certificate that can be sent back to the user. The user then uses that new certificate to make an SSL connection with the host.

If the Certificates are requested and verified upon connection option found on the SSL Option tab is selected, the certificate the administrator uses to sign the certificate signing request must be listed in the Trusted Authorities tab for that host. If not, any SSL connection that tries to use that certificate will fail.

To sign a certificate:

  1. In the Private Key box, select the private key you want to use to sign the request by clicking on the Browse button and selecting the file.

  2. In the Certificate box, select the certificate associated with that private key.

  3. Enter the pass phrase associated with that private key/certificate in both the Pass Phrase box and the Pass Phrase Confirmation box.

  4. In the Request File box, select the request file you want to sign by clicking on the Browse button and selecting the file.

  5. In the Active Date box, enter the date the certificate is activated, or use the pull-down button to select the date from a calendar.

  6. In the Expires On box, enter the date the certificate expires on, or use the pull-down button to select the date from a calendar.

  7. In the Output Certificate box, enter the file name and complete path of the certificate that is to be generated by signing the request. You can click the Browse button to enter the name and select the folder you want to create the file in.

Usually, the output certificate file uses the same name as the request file.

  8. Click the Sign button to sign the request and create the new certificate.

  9. The certificate that was created should now be sent back to the user. If the certificate file used to sign the request is not listed in the Trusted Authorities tab for that host, you should add it now.


SSL Options

Certificates are requested and verified upon connection. When this option is selected, the server asks for a certificate from the user attempting to make a connection. That server then tries to verify that server against the certificates listed for that host on the Trusted Authorities tab. If the certificate is not listed there, for that host, then the SSL connection will fail.


Trusted Authorities

The Trusted Authorities tab stores a list of certificate names that are recognized by you client. If you use the Certificates are requested and verified upon connection option found on the SSL Option tab, any user that tries to make an SSL connection must have their certificate signed by a certificate that has been added to this host’s database, or have the certificate itself in the database.

Certificate Display

  • Issued To. Who the certificate was issued to.

  • Issued By. Who the certificate was signed by.

  • Expires. Date on which the certificate expires.

Related Topics

Adding a certificate

Exporting a certificate

Removing a certificate


Importing a certificate

To add a certificate to the database:

  1. With WS_FTP, go to step #2. If you are using WS_FTP Server, select the host name you want to add the certificate to with the pull-down list on the Certificate Store box.

  2. Click the Import button and select the path and file name for the certificate. The Add Certificate? window appears.

  3. Review the information on that window and click Yes to add the certificate to the database.


Exporting a certificate

To export a certificate from the Trusted Authorities database:

  1. Select the certificate you want to copy out of your database.

  2. Click the Export button.

  3. Select the folder you want to copy the certificate to and enter the name you want to save the certificate file as.

  4. Click OK.


Removing a certificate

To remove a certificate:

  1. Select the certificate to be removed.

  2. Click Remove.

  3. A warning appears advising you to export the certificate before you remove it. Removing the certificate will delete the certificate file.

  4. Click OK to remove the certificate.


Certificate

A certificate is an identification file used in connection negotiations. Certificate files have the ending *.crt


Certificate Signing Request

This file is created when the certificate is generated. It is to be sent to your server administrator to be signed and returned to you. The file has the ending *.csr


Client Certificate Verification

If the server you are attempting to make a connection to requires your client to send a certificate back to the server, you must:

  1. Configure the site with the Secure (SSL) option selected.

  2. Create a certificate.

  3. Send the certificate signing request file to your server administrator.

  4. Once the server administrator signs your certificate signing request, it will be sent back to you.

  5. When you receive the file, follow the directions for selecting a certificate, selecting the new certificate to go in the Certificate box.

  6. Connect to the server


Non-Trusted Certificate

When you connect to a server using the SSL connection option, that server sends you a certificate. If that certificate is not listed on the Trusted Authority tab, or if it was not signed by a certificate on this list, this window appears.

Certificate Information

  • Issued To. Name of the person or company who the certificate belongs to.

  • Issued By. Name of the person or company who signed the certificate.

  • Active From. The date on which this certificate was activated.

  • Expires On. The date the displayed certificate will no longer be a valid certificate.

Options

  • Allow this connection only. If this option is selected, the connection will be made, but WS_FTP will still not recognize the certificate as a trusted authority. The next time you attempt to connect to this server, this window appears once again.

  • Trust this certificate. If this option is selected, the connection will be made and the certificate will be added to the trusted authority database in the Trusted Authority tab.

  • Do not allow this connection. If this option is selected, the connection will be terminated.


Private Key

The private key is a protected file that is used to create certificates and public keys used in establishing an SSL connection. Data encrypted with a public key can only be decrypted with the private key that was used to create it. Private key files have the ending *.key. Do NOT distribute your private key to anyone.