FTP 101 – Part 12: FTPS client compatibility and usage

Published {$created} by Carsten Blum

FTPS (FTP over TLS) is a secure extension of the classic FTP protocol. Unlike SFTP, which uses SSH, FTPS wraps FTP in TLS encryption – but it still inherits FTP’s complexity. In this guide, we’ll explore which clients support FTPS, how to deal with firewall issues, and how to upload or download securely using curl and lftp.

FTPS Client Compatibility

Not every FTP client supports FTPS. Even among those that do, support may vary between explicit (FTPES) and implicit TLS.

Note: ftpGrid supports explicit TLS (FTPES). This is more secure and firewall-friendly than the older implicit TLS method.

FTPS Behind Firewalls

Unlike SFTP, FTPS maintains the FTP architecture with separate data and control channels – meaning multiple ports are in use.

Common firewall issues:

• Passive ports blocked (e.g. 21000–21050)

• TLS negotiation fails due to deep packet inspection

• NAT breaks the data connection after TLS handshake

Best practices:

• Always use passive mode

• Allow the passive port range in both server and client firewalls

• Disable TLS inspection on port 21 if your network appliance supports it

ftpGrid is preconfigured with passive ports and handles TLS certificates automatically via Let’s Encrypt.

Uploading & Downloading with curl

To download a file over FTPS using curl:

curl --ftp-ssl --user "myuser:secret" ftp://ftpgrid.com/myfolder/file.txt

To upload a file:

curl --ftp-ssl --user "myuser:secret" --upload-file ./local.txt ftp://ftpgrid.com/myfolder/

You can add --ssl-reqd if your version of curl supports it, to force TLS.

Using lftp with FTPS

Start by connecting:

lftp -u myuser,secret ftps://ftpgrid.com

Ensure passive mode and FTPS are enabled:

set ftp:passive-mode onset ftp:ssl-force trueset ftp:ssl-protect-data true

Upload a file interactively:

put backup.zip

Or use a scripted session:

lftp -u myuser,secret ftps://ftpgrid.com <<EOFcd myfolderput file.txt
bye
EOF

Summary

FTPS can be a bit tricky due to its heritage – but it remains a secure and well-supported protocol. For automation, curl and lftp offer excellent command-line control. Just remember to enable explicit TLS, use passive mode, and check firewall rules if you run into issues.

With ftpGrid, you get explicit TLS by default, passive mode with known port ranges, and certificates handled via Let’s Encrypt – no manual configuration required.

Coming up next: We'll compare SFTP and FTPS in production scenarios and help you choose the right one for your use case.