FTPS certificate expired

FTPS certificate expired breaks explicit TLS (AUTH TLS) and implicit FTPS (port 990) when the listener’s server certificate is past notAfter—FileZilla and WinSCP show SSL handshake failed while plain FTP on port 21 may still appear to work until clients demand encryption.

File transfer partners often retry for hours without opening tickets. Batch jobs using lftp or cron curl -u ftps URLs fail with generic TLS errors easy to blame on passwords.

FTPS is not SFTP (SSH). The certificate you renew is the FTP daemon’s TLS cert, usually the same PEM as a corporate wildcard unless you use per-service names.

First response

Record hostname, port (21 with AUTH TLS, 990 implicit, or custom), and client (FileZilla, WinSCP, lftp, Windows IIS FTP). Capture server software—ProFTPD, vsftpd, Pure-FTPd, Microsoft FTP.

Note whether control connection is plain and TLS starts only after AUTH TLS, or whether entire session expects TLS on connect. Passive mode IP in PASV responses must still match DNS for data channel issues separate from cert expiry.

Save server log lines around SSL_accept or certificate errors. Confirm whether a front firewall does SSL inspection with its own expiring cert.

Ask partners whether they use explicit FTPS only or implicit on 990—your renewal must cover whichever mode still appears in integration manuals from years ago.

Document cipher requirements in banking specs; sometimes renewals default to modern suites that legacy mainframe clients reject, sounding like SSL failure though dates are valid.

What this error means

Partner operations teams frequently measure file transfer availability separately from customer web properties, which means FTPS certificate expiry can blindside account managers even when public marketing sites pass audits. Narrate incidents with the exact hostname, port mode, and notAfter value partners need for their own compliance records. Treat successful control channel negotiation followed by data channel failure as a distinct subcategory requiring passive port and PROT configuration review, not a signal that certificate renewal was unnecessary.

FTPS wraps the FTP control channel in TLS similarly to HTTPS: after TCP connect (or after AUTH TLS command on port 21), the server presents an X.509 certificate. Clients verify trust and dates before encrypted USER/PASS credentials flow.

Expired leaf or intermediate aborts before login. Wrong hostname in cert fails name checks with different messages but equal severity.

Data connections in passive mode open separate TCP sockets; they reuse the session from the control channel rather than presenting a new cert on each data port in typical configs. Focus renewal on the main TLS listener configuration path in your daemon.

Compare patterns with check mail server TLS expiry when other legacy cleartext-upgrade protocols fail similarly after renewal gaps.

PROT P commands protect data channels on explicit FTPS; if control TLS succeeds with valid dates but data fails, look at passive certificate reuse and firewall pinholes before assuming renewal missed.

Windows IIS FTP logs expose SslPolicyErrors bitmask when expired—enable detailed errors temporarily for partner calls during incident bridges.

Common causes

Wildcard web cert renewed but FTP virtual host still references old cert.pem path on vsftpd. Windows IIS FTP site binding updated in HTTP sysadmin UI but not FTP over SSL settings.

Load balancer terminates FTPS and backend speaks plain FTP—edge cert expired while ops renewed origin web certs only. Automation copied PEM to nginx but not to ProFTPD TLSRSACertificateFile.

Passive address NAT changed; unrelated to expiry unless troubleshooting conflates errors. Still fix cert dates first via OpenSSL.

Legacy clients without SNI connect to shared IP default cert that expired while named site certs were renewed on another binding.

Batch settlement files and HIPAA-style partner SLAs treat missed FTPS windows as severity-1 even when marketing sites stay green. Communicate proactive maintenance when renewals require passive port firewall updates alongside the TLS PEM swap.

Confirm from the outside

OpenSSL implicit FTPS (990)

FTP=ftp.example.com
echo | openssl s_client -connect "$FTP:990" -servername "$FTP" 2>/dev/null \
  | openssl x509 -noout -dates -subject -issuer

Explicit TLS on 21 (after STARTTLS-style negotiation)

Use openssl s_client -starttls ftp -connect "$FTP:21" when supported:

echo | openssl s_client -starttls ftp -connect "$FTP:21" -servername "$FTP" 2>/dev/null \
  | openssl x509 -noout -dates

lftp probe

lftp -u user,pass -e "set ftp:ssl-force true; set ssl:verify-certificate yes; ls; quit" "ftps://$FTP/"

FileZilla

Enable debug logging in FileZilla Client; note SSL connection established versus certificate expired before credential lines.

Fix checklist

1. Identify daemon config keys (rsa_cert_file, ssl_cert, IIS FTP SSL cert dropdown) actually loaded at runtime.
2. Confirm past notAfter on live port with OpenSSL starttls or 990 check.
3. Renew cert covering FTP hostname SAN; include full chain file per vendor docs.
4. Deploy PEM to FTP service paths; restart daemon or recycle IIS site—not only web tier.
5. If TLS terminates on load balancer, renew edge cert and confirm backend pool health separately.
6. Re-test explicit and implicit modes your partners use; document which ports are supported.
7. Remove client-side set ssl:verify-certificate no hacks added during incident.
8. Add FTP hostname and ports to live TLS monitoring inventory.

Validate both control and data channels after renewal: upload and download a test artifact larger than passive block size thresholds. Some servers present renewed control certs but inherit stale cipher configs that break only during encrypted data transfer, which partners report as generic “SSL failed” without distinguishing control versus data phase.

Coordinate with network teams when passive port ranges publish in DNS (EPSV responses). Certificate renewal maintenance is also a good time to confirm those ranges still match firewall holes documented with each partner years ago.

Partner management should receive proactive notice naming the FTPS hostname, maintenance window, and whether implicit or explicit modes are in scope. After renewal, request a short confirmation upload from each critical partner rather than assuming silence means success. Archive those confirmations with serial numbers for compliance audits that ask whether file transfer paths remained encrypted during certificate rotation.

When to use automation

Partner SFTP/FTPS endpoints rarely appear in marketing uptime dashboards. Schedule external TLS checks on the hostname and port combination your firewall publishes, including 990 if used.

Pair expiry alerts with RDAP on the domain when using manual OV renewals. File transfer outages are revenue-impacting—use 30/14/7/1 day thresholds before batch windows.

Schedule synthetic FTPS uploads from an external vantage point that mirrors partner IP allowlists. Internal tests through the same VPN as admins miss expired certs visible only on the public listener partners use. Log serial numbers after each renewal in the partner-facing status page to reduce duplicate tickets.

Document whether your PKI team or the vendor hosting managed SFTP adjacent to FTPS owns renewal—partners conflate the two protocols in email subjects. Clear ownership shortens expiry bridges.