How to Fix FTPS Certificate and TLS Errors Safely
FTPS protects an FTP connection with a TLS certificate. Instead of blindly accepting a warning, verify the host name, validity period, certificate chain and unexpected server changes.
What does an FTPS certificate verify?
A TLS certificate helps verify the identity of the FTPS server and encrypts FTP traffic. The client checks whether the certificate is trusted, valid for the current date and issued for the host being used.
This is not the same as an SSH server host key. FTPS uses TLS certificates; SFTP uses SSH host keys.
Common certificate warnings
The certificate may cover ftp.example.com while the client connects by IP address or another host name.
The certificate was not renewed or the FTP service is still using an old file.
The server or device clock may be wrong, or the certificate start date has not arrived.
The server may use a self-signed certificate or fail to send an intermediate certificate.
This may be a normal renewal, provider change or redirection to an unexpected server.
Check before accepting the warning
- 1Verify the server address
Use the exact FTPS host supplied by the provider; a raw IP may not match the certificate.
- 2Review validity dates
Confirm the device clock and make sure the certificate is currently valid.
- 3Review the subject and issuer
The host name and certificate chain should match the expected provider.
- 4Confirm an unexpected change
Ask the host or administrator when a previously known certificate changes without notice.
- 5Trust only after verification
Do not store a permanent exception until the information has been checked.
An unexpected certificate can indicate the wrong server or redirected traffic. Do not trust it permanently without verification.
Match explicit and implicit FTPS
Choosing implicit FTPS when the server expects explicit FTPS, or the reverse, can cause a TLS handshake failure before a certificate is displayed. Match the provider’s method and port.
These ports are common defaults; an administrator can configure different values.
| Type | Common port | TLS starts |
|---|---|---|
| Explicit FTPS | Usually 21 | Client upgrades with AUTH TLS |
| Implicit FTPS | Usually 990 | TLS is used from the first packet |
What should the server administrator fix?
The Subject Alternative Name must include the FTP domain used by clients.
The server should send required intermediate certificates, not only the leaf certificate.
A renewed certificate must be installed in the FTP service and safely reloaded when necessary.
The server and client need a shared set of secure TLS versions and cipher suites.
Clearing a previously trusted certificate
If you previously stored an exception and the server has now installed a valid replacement, clear saved certificate permissions in the app and verify the new certificate again.
Clearing the local record does not change the certificate on the remote server. It only removes the certificate decision stored on the device.
After clearing the record, inspect the host name, dates and issuer before trusting the new certificate.
Put the guide into practice.
Review the related Varkuna product or open its detailed user guide.