TLS Certificates

All flexFS server components communicate over TLS by default. On first startup, each server automatically generates a self-signed certificate if neither a certificate nor a key is found.

Auto-generated certificates

When a server starts and finds neither a certificate nor a key at its configured paths, it generates a self-signed certificate with the following properties. If only one of the two files exists, the server refuses to start and reports which file is missing.

Property	Value
Key type	ECDSA P-256
Subject	CN=flexfs, O=Paradigm4, Inc., L=Boston, ST=Massachusetts, C=US
DNS SANs	localhost
IP SANs	127.0.0.1, ::1
Validity	100 years (876,000 hours)
Key usage	Digital Signature, Key Encipherment
Extended key usage	Server Authentication
Serial number	128-bit random (per RFC 5280)
File permissions	0600 (owner read/write only)

Auto-generated certificates are suitable for development and internal deployments. For production deployments accessible over the internet, use custom certificates issued by a trusted CA.

Custom certificates

To use your own TLS certificates, provide the cert and key files via command-line flags on the server:

Metadata server (meta.flexfs)

meta.flexfs start --sslCert /path/to/cert.pem --sslKey /path/to/key.pem

Proxy server (proxy.flexfs)

proxy.flexfs start --sslCert /path/to/cert.pem --sslKey /path/to/key.pem

Admin server (admin.flexfs)

admin.flexfs start --sslCert /path/to/cert.pem --sslKey /path/to/key.pem

Free server (free.flexfs)

free.flexfs start --sslCert /path/to/cert.pem --sslKey /path/to/key.pem

Tip

The certificate file should contain the full chain (server certificate followed by any intermediate certificates) in PEM format. The key file should contain the private key in PEM format.

Certificate paths

Each server stores its auto-generated certificate and key under the flexFS home folder:

Server	Default cert path	Default key path
meta.flexfs	~/.flexfs/ssl/cert	~/.flexfs/ssl/key
proxy.flexfs	~/.flexfs/ssl/cert	~/.flexfs/ssl/key
admin.flexfs	~/.flexfs/ssl/cert	~/.flexfs/ssl/key
free.flexfs	~/.flexfs/ssl/cert	~/.flexfs/ssl/key

All servers share the same default certificate paths. When using --sslCert and --sslKey, the server reads from the specified paths instead.

Disabling TLS

TLS can be disabled on individual servers, for example for testing in trusted internal networks or behind a reverse proxy (e.g., nginx) or load balancer that handles TLS termination:

Component	Flag
meta.flexfs	--noSSL
proxy.flexfs	--noSSL
admin.flexfs	--noSSL
free.flexfs	--noSSL

--noSSL affects only the server. Mount clients and the command-line tools always connect with HTTPS unless told otherwise:

• Behind a TLS-terminating reverse proxy or load balancer, clients keep using HTTPS to the proxy, so no client changes are needed. For meta.flexfs, the proxy must also pass WebSocket connections through, because mount clients hold their session over a WebSocket. API access rules cannot tell clients apart behind a proxy, since every request arrives from the proxy’s address.
• Clients connecting directly to a --noSSL server must be started with the matching Internal flag: --noAdminSSL for an admin or free server, --noMetaSSL for a metadata server, or --noProxySSL for a proxy server. Without it they cannot connect; for a proxy server, mounts treat the proxy group as unreachable and read and write object storage directly.

Caution

Disabling TLS exposes all traffic — including authentication tokens — in plaintext. Only disable TLS in trusted network environments.

Certificate rotation

To rotate certificates:

1. Replace the certificate and key files at the configured paths.
2. Restart the server process. The new certificate will be loaded on startup.

Connected clients reconnect automatically after the restart.

Next steps

• Authentication — token-based auth model
• End-to-end encryption — AES-256 encryption for data at rest