any time. The only restriction comes from the FTPS server, which has the ability to deny commands based on server encryption policy. Secure command channel The secure command channel mode can be entered through the issue of either the AUTH TLS or AUTH SSL commands. After such time, all command control between the FTPS client and server are assumed to be encrypted. It is generally advised to enter such a state prior to user authentication and authorization in order to avoid the eavesdropping of user name and password data by third parties. Secure data channel The secure data channel can be entered through the issue of the PROT command. It is not enabled by default when the AUTH TLS command is issued. After such time, all data channel communication between the FTPS client and server is assumed to be encrypted. The FTPS client may exit the secure data channel mode at any time by issuing a CDC (clear data channel) command. Reasons to disable encryption It may not be advantageous to use data channel encryption when performing transfers under the following scenarios: Files being transferred are of a non-sensitive nature, making encryption unnecessary, Files being transferred are already encrypted at the file level or are passing over an encrypted VPN, making encryption redundant, Available TLS or SSL encryption modes do not meet desired level of encryption. This is common with older FTPS clients or servers that may have been limited to 40-bit SSL due to previous United States high-encryption export laws. It may not be advantageous to use control channel encryption under the following scenarios: Use of FTPS when the client or server reside behind a network firewall or network address translation (NAT) device. (See Firewall Incompatibilities below.) Repeated use of AUTH and CCC/CDC commands by anonymous FTP clients within the same session. Such behavior can be used as a resource-based denial of service attack as the TLS/SSL session must be regenerated each time, using server processor time. SSL certificates Much like HTTPS, FTPS servers must provide a public key certificate. These certificates can be requested and created using tools such as OpenSSL. When these certificates are signed by a trusted certificate authority, this provides assurance that the client is connected to the requested server, avoiding a man-in-the-middle attack. If the certificate is not signed by a trusted CA (a self-signed certificate), the FTPS client may generate a warning stating