Home › Topics › FTPS In Depth

FTPS In Depth

FTPS is what happens when classic FTP puts on TLS encryption — the same technology that secures websites. It keeps FTP's familiar two-connection design and adds certificate-based trust. This makes it a natural upgrade path for existing FTP workflows and a common requirement in partner exchanges.

It also inherits FTP's firewall complications and adds certificate management on top, so there is real substance to learn. This series covers the two flavors (explicit and implicit), what TLS actually protects on each channel, and the certificate errors everyone meets. It also covers getting FTPS through firewalls and a practical hardening pass.

Articles in This Series

Explicit vs Implicit FTPS: Two Flavors, One Endless Source of Confusion
AUTH TLS vs the dedicated port, and which to offer.
How TLS Wraps FTP: Control Channel, Data Channel, and the Session-Reuse Wrinkle
PROT, CCC, and the compatibility grief of TLS session reuse.
Certificates for FTPS: Issuance, Validation, and the Errors in Between
Chains, name matching, self-signed tradeoffs, and decoding the classic failures.
FTPS Through Firewalls and NAT: Why Encryption Breaks the Old Tricks
Inspection helpers go blind under TLS — and the publishing patterns that work.
Hardening FTPS: Protocol Versions, Ciphers, and Configuration Pitfalls
Minimum versions with reasoning, cipher policy, and a verification pass.
The FTPS Client Compatibility Matrix
Session reuse, implicit support, resume behavior — quirk by quirk.
FTPS Server on Windows - Setup, Certificate, and Testing
This article is the hands-on setup guide. It covers getting a certificate onto a Windows server, requiring TLS, choosing explicit or implicit mode, the firewall rules an encrypted session needs, connecting and testing, the faults specific to FTPS, and certificate renewal.

Frequently Asked Questions

What is FTPS?

FTPS is FTP with TLS encryption wrapped around it: the same commands, replies and two-connection model as classic FTP, but the control connection and each data connection are encrypted and the server presents an X.509 certificate. Explicit FTPS starts on port 21 and upgrades with AUTH TLS; implicit FTPS assumes TLS from the first byte on port 990. It is unrelated to SFTP, which runs inside SSH.

Is FTPS secure?

Yes, when the server requires modern TLS versions, strong ciphers, encrypted data connections (PROT P) and a valid certificate, and when plain FTP is switched off so nothing can fall back to cleartext. The hardening article in this series walks through each of those settings and how to verify them from outside.

Should I choose FTPS or SFTP?

If you are free to choose, SFTP is simpler to run: one port, no certificates, key-based logins. Choose FTPS when a partner's software requires it, when an existing FTP workflow must gain encryption with minimal change, or when certificate-based trust is a stated requirement. Many Windows servers offer both from one installation, which sidesteps the choice.

Explore More Topics

This series is part of the Sysax file transfer topic library. The library covers the protocols, security practices, automation techniques, and operational skills behind reliable file transfer. The library pairs well with the practical tools we build. Sysax Multi Server is a secure FTP, FTPS, SFTP, and HTTPS server for Windows. Sysax FTP Automation schedules and scripts secure transfers so the routine ones run themselves.