How to Setup ProFTPD on Ubuntu Linux with SSL/TLS Certificates

This article describes steps one can take to set up ProFTPD on Ubuntu Linux with SSL/TLS certificates.

When transferring files to a remote server, File Transfer Protocol (FTP) is still one of the easiest ways to do it. However, when using FTP, it’s better to add some encryptions by using SSL/TLS protocols.

The reasons you may want SSL/TLS enabled on FTP is that FTP communicates over insecure channel, and someone with the right tool could intercept data between the server and client read it.

With SSL/TLS, even if the data is intercepted, they may still be unable to read the content, and that’s because of the extra security.

For this post, we’re going to be using a self-signed certificate. If you can afford public cert, then more power to you.

How to Install ProFTPD on Ubuntu Linux

First, you’ll want to install ProFTPD. To do that in Ubuntu Linux, run the commands below.

sudo apt update 
sudo apt-get install proftpd

During the installation, you should get a prompt with the message below: Select standalone

 ProFTPD can be run either as a service from inetd, or as a standalone server. Each choice has its own 
 benefits. With only a few FTP                                                                           
 connections per day, it is probably better to run ProFTPD from inetd in order to save resouces.                                                                                                  
 Run proftpd:                                                                                                                                                                            
                                 from inetd                                                            

After installing ProFTPD, the commands below can be used to stop, start and enable the server service to always start up when the server boots.

sudo systemctl stop proftpd.service
sudo systemctl start proftpd.service
sudo systemctl enable proftpd.service

How to create a self-signed SSL/TLS certificate

Now that ProFTPD is installed, run the commands below to generate a self-signed SSL/TLS certificate for the server.

The commands create a server key called proftpdserverkey.pem and store it in /etc/ssl/private and a certificate file called proftpdcertificate.pem in the /etc/ssl/certs.

sudo openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/ssl/private/proftpdserverkey.pem -out /etc/ssl/certs/proftpdcertificate.pem -days 365

After running the commands above, you’ll be prompted to answer few questions about the certificate you’re generating… answer them and complete the process.

Generating a 2048 bit RSA private key
writing new private key to '/etc/ssl/private/proftpdserverkey.pem'
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]:New York
Locality Name (eg, city) []:Brooklyn
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Website for Students
Organizational Unit Name (eg, section) []:SSL Unit
Common Name (e.g. server FQDN or YOUR name) []
Email Address []:[email protected]

VSFTP server will use the key and certificate created above.

How to configure ProFTPD to use SSL/TLS certificate

Now that you’ve generated the server private key and certificate files, go and configure ProFTPD to use the SSL/TLS certificate created above. To do that, run the commands below to open ProFTPD default tls configuration file.

sudo nano /etc/proftpd/tls.conf

Then make the highlighted changes below so that the server can could communicate over SSL/TLS.

# This option specifies the location of the RSA certificate to use for SSL
# encrypted connections.
TLSRSACertificateFile /etc/ssl/certs/proftpdcertificate.pem
TLSRSACertificateKeyFile /etc/ssl/private/proftpdserverkey.pem
TLSEngine on
TLSLog /var/log/proftpd/tls.log
TLSProtocol SSLv23
TLSRequired on
TLSOptions NoCertRequest EnableDiags NoSessionReuseRequired
TLSVerifyClient off

Save your changes and restart the server.

Next, open ProFTPD default configuration file and comment out this line to include the tls.conf configurations.

sudo nano /etc/proftpd/proftpd.conf

uncomment the line as shown below:

# This is used for FTPS connections
Include /etc/proftpd/tls.conf

Save the file exit

After adding the highlighted lines to the file, save it. Then run the commands below to restart ProFTPD server.

sudo systemctl restart proftpd

Now grab your favorite FTP client (FileZilla) and setup a new site in your site manage and use FTP protocol with encryption with explicit FTP over TLS. Type your username and password and connect.

vsftpd ssl connection

You should be prompted with a certificate. accept the certificate and continue. You may check the box at the bottom of the page to trusted the certificate so you don’t get prompted in the future.

vsftpd ubuntu ssl

You should now be transferring files securely via SSL/TLS.

vsftpd ubuntu ssl



This post showed you how to install ProFTPD on Ubuntu Linux with SSL/TLS. If you find any error above or have something to add, please use the comment form below.