FTPS TLS certificates

Connecting over FTPS encrypts your traffic and lets your client verify it is talking to the right server. DocEvent offers FTPS two ways:

• Explicit FTPS (port 21) - the connection starts as FTP and upgrades to TLS with AUTH TLS
• Implicit FTPS (port 990) - TLS from the first byte

The certificate

Each region presents a certificate for its own hostname - for example sfs-us-east-1.docevent.io - issued by Let's Encrypt.

Let's Encrypt certificates are valid for around 90 days and are renewed automatically well before expiry. Because the certificate itself rotates regularly:

• Do trust the Let's Encrypt / ISRG root certificates in your client or application. They ship with every current OS and browser trust store; if your application uses its own bundle, add the ISRG roots to it.
• Do not pin the leaf certificate or its fingerprint - it changes at every renewal and your transfers will start failing when it does.
• Do verify that the certificate's common name matches the regional hostname you are connecting to.

If your client reports a name mismatch, check that you are connecting to the regional hostname directly - a custom CNAME cannot work for FTPS.