SLIFT (Legacy) encryption and decryption

Note: SLIFT should only be used if you cannot use PGP keys or have a specific use case that requires it — PGP is the default recommended option.

CFT supports SLIFT sender decryption and receiver encryption, ensuring security throughout the transfer. CFT ensures that data is encrypted both at-rest and in-transit by default, even when SLIFT is not enabled.

CFT provides an X.509 public certificate using the RSA algorithm with a 2048-bit key for encryption. This certificate is generated in .crt format.

Note: Public certificates and keys generated by CFT have a default and recommended validity of 1 year. Do not input a validity of more than 1 year without first contacting CFT for the required waivers and processes.

• SLIFT sender decryption
• SLIFT receiver encryption

Important notes

• When SLIFT decryption is enabled, the .p7 file extension is automatically removed from the filename post-decryption. Conversely, when SLIFT encryption is enabled, the .p7 file extension is appended to the filename.

• Only Tenant Managers can create and manage SLIFT keys.

SLIFT sender decryption

Follow these steps to set up SLIFT sender decryption.

Optional: You can enable file encrypt or decrypt failure webhook notifications in a workflow.

Note: For an HTTPS Client Sender setup, you need to specify .p7 file extension in the Allowed File Extensions field.

Convert key format to .cer

The public certificate from CFT is generated in .crt format. You need to convert the sender key to SLIFT .cer format, and use it to encrypt your file.

To perform the conversion, use the following command:

openssl x509 -outform der -in '<input_crt_file_name>' -out '<output_cer_file_name>'

For example: openssl x509 -outform der -in 'CFT.crt' -out 'CFT.cer'

In this command, CFT.crt represents the file containing the Sender key or public certificate generated by CFT.

SLIFT receiver encryption

Follow these steps to set up SLIFT receiver encryption.

For a Sender decryption setup, you need to add .pgp (PGP) or .p7 file extension as an allowed file extension.

Important: Ensure that the key size is not more than 2048 bits.

Convert key format to .crt

By default, SLIFT public certificates or keys are generated in .cer format. You need to convert the SLIFT receiver key to .crt format to be able to add it to your project in the CFT Admin Portal.

To perform the conversion, use the following command:

openssl x509 -inform der -in <input_cer_file_name> -out <output_crt_file_name>

For example: openssl x509 -inform der -in receiver.cer -out receiver.crt

In this command, receiver.cer represents the file containing the SLIFT encryption key you have generated. After the conversion, you can copy the contents of receiver.crt and add the key to your project the CFT Admin Portal.

Manage expired keys

For expired Sender keys you will need to:

1. Create a new Sender key in the CFT Admin Portal.
2. Update the workflow, selecting the new key.

For expired Receiver keys, you will need to:

1. Generate a new public key. Receiver keys are used to encrypt the file when sending it to the receiver application, so you need to generate your own public key.

2. Replace the expired key with your new key in the CFT Admin Portal.

You can also re-validate that your workflow is configured with the correct keys.