Here’s a concise guide to configuring SSL certificates for vsftpd on Ubuntu:
Update your package list and install vsftpd:
sudo apt update
sudo apt install vsftpd
You can use Let’s Encrypt (free) or purchase a commercial certificate. For Let’s Encrypt:
sudo apt install certbot
sudo certbot certonly --standalone -d yourdomain.com
This creates certificates at /etc/letsencrypt/live/yourdomain.com/ (fullchain.pem and privkey.pem).
Edit the vsftpd configuration file:
sudo nano /etc/vsftpd.conf
Add/modify these settings:
ssl_enable=YES
rsa_cert_file=/etc/letsencrypt/live/yourdomain.com/fullchain.pem
rsa_private_key_file=/etc/letsencrypt/live/yourdomain.com/privkey.pem
force_local_data_ssl=YES
force_local_logins_ssl=YES
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO
allow_anon_ssl=NO
local_enable=YES
write_enable=YES
Save and exit (Ctrl+O, Enter, Ctrl+X).
Apply changes by restarting the service:
sudo systemctl restart vsftpd
Allow FTP (port 21) and FTPS (port 990) traffic:
sudo ufw allow 21/tcp
sudo ufw allow 990/tcp
sudo ufw reload
Use an FTP client like FileZilla to connect to your server. Select “FTPES” (explicit TLS) as the encryption method. You should see a secure connection established.
