Apache FTPServer Project > Index > Documentation > TLSSSL Support

TLS/SSL Support

This document explains how to enable Apache FTP Server to use Transport Layer Security (TLS) for encrypted client-server communication.

FtpServer uses the Java Secure Sockets Extension (JSSE) infrastructure to provide TLS/SSL sockets. JSSE comes packaged with several vendor Java distributions (i.e. Sun Java 1.4.x, IBM Java 1.3.x). For these distributions, please follow the vendor provided instructions for configuring the JVM to use JSSE services.

Explicit Security (default)

In this mode server supports both secure and non-secure connection. Upon request from client (AUTH SSL) the server switches to the SSL/TLS mode.

In this case, the listener should not use implicit SSL (the default value):

config.listeners.default.implicit-ssl=false

Implicit Security

If you want to use implicit SSL connection, that is, SSL is always enabled on the control socket. The first thing you need to do is to tell the listener to use implicit SSL mode:

config.listeners.default.implicit-ssl=true

Control socket security

config.listeners.<listener name>.ssl.class Required, no default value, normally set to org.apache.ftpserver.ssl.DefaultSsl
config.listeners.<listener name>.ssl.keystore-file Keystore file location. The default path is ./res/.keystore
config.listeners.<listener name>.ssl.keystore-password Keystore password. The default value is password.
config.listeners.<listener name>.ssl.keystore-type Keystore type. The default value is JKS.
config.listeners.<listener name>.ssl.keystore-algorithm Keystore algorithm. The default value is SunX509.
config.listeners.<listener name>.ssl.key-password Key password. The default value is password.
config.listeners.<listener name>.ssl.enabled-cipher.suites A comma seperated list of cipher suites to enable for this connection. The exact cipher suites that can be used depends on the Java version used, here are the names for Sun's JSSE provider.
config.listeners.<listener name>.ssl.ssl-protocol SSL protocol. The default value is TLS.
config.listeners.<listener name>.ssl.client-authentication Client authentication. The default value is false. Set to true to require client authentication, or want to require client authentication.

Data socket security

Implicit secure socket does not ensure encrypted data transfer. To use SSL/TLS in data connection, client has to send "PROT P" command. You also need to set the keystore configuration parameters. Encrypted data transfer is supported for FTP passive (PASV) mode only.

Data socket configuration supports the same options at the control socket, as described above. However, they are set up the data-connection parameter, for example:

config.listeners.<listener name>.data-connection.ssl.keystore-file