We recently addressed issues affecting the Box FTP service. We would like to take the opportunity to further explain these issues and the steps we have taken to keep them from happening in the future.

Between 4:00 PM and 7:29 PM PST on Nov 17, 2021, some users may have experienced difficulties while working in Box. During this time, clients validating the SSL chain of trust were unable to connect to our FTP servers. The issue occurred as a result of FTP certs expiration. During this time, use of other Box applications, including the Box web application, Box desktop applications, or Box APIs was not affected. We were able to resolve the issue by generating and deploying a new Java Keystore. In addition, we will define a process to monitor and update FTP certs to prevent similar issues from occurring in the future.

Analysis 
FTP service is an application layer built on top of upload and download API. It allows users to upload and download files using FTP protocol. Box supports both encrypted FTP and unencrypted FTP protocol.

In this incident, the FTP SSL certificate expired at 4:00 PM PST on Nov 17, 2021. As a result, users trying to establish new SSL connections to FTP hosts were unable to connect. We were able to resolve the issue by generating and deploying a new Java Keystore.

Corrective Actions
The following corrective actions have been completed or are planned:

• Set up a process to better monitor upcoming FTP cert expiration;
• Define and document the process to manage and renew FTP certs;
• Review FTP Runbook and update the process to manage FTP certs;
• Include FTP Catchpoint test results in FTP dashboard.

We are continuously working to improve Box and want to make sure we are delivering the best product and user experience we can. We hope we have provided some clarity here and we would be happy to answer any questions you may still have regarding this matter.

Sincerely,
The Box Team