FTP is still one of the easiest ways to upload and download files from remote serves. However, when using FTP, it’s better to add some levels of security by using SSL/TLS protocols.
This post shows students and new users how to install and configure Pure-FTPD to use SSL/TLS certificates on Ubuntu 16.04 LTS server with encryption enabled.
The reasons you may want SSL/TLS enabled on FTP is that FTP communicates over insecure channel. and someone with the right tool could intercept data between the server and client read it. With SSL/TLS, even if the data is intercepted, they may still be unable to read the content, and that’s because of the extra security.
For this post, we’re going to be using a self-signed certificate. If you can afford public cert, then more power to you.
Step 1: Install Pure-FTPD on Ubuntu 16.04 LTS
To install Pure-FTPD on Ubuntu, run the commands below.
sudo apt update sudo apt-get install pure-ftpd
After installing Pure-FTPD, the commands below can be used to stop, start and enable the server service to always start up when the server boots.
sudo systemctl stop pure-ftpd.service sudo systemctl start pure-ftpd.service sudo systemctl enable pure-ftpd.service
Step 2: Create a Self-signed SSL/TLS certificate
Now that Pure-FTPD is installed, run the commands below to generate a self-signed SSL/TLS certificate for the server. the commands create both the server key and certificate files and store in /etc/ssl/private directory.
It’s important that you keep both server key and certificate files names to be pure-ftpd.pem and should live in the /etc/ssl/private directory.
sudo openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/ssl/private/pure-ftpd.pem -out /etc/ssl/private/pure-ftpd.pem -days 365
After running the commands above, you’ll be prompted to answer few questions about the certificate you’re generating… answer them and complete the process.
Generating a 2048 bit RSA private key ...+++ .+++ writing new private key to '/etc/ssl/private/pure-ftpd.pem' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:US State or Province Name (full name) [Some-State]:New York Locality Name (eg, city) []:Brooklyn Organization Name (eg, company) [Internet Widgits Pty Ltd]:Website for Students Organizational Unit Name (eg, section) []:SSL Unit Common Name (e.g. server FQDN or YOUR name) []:example.com Email Address []:webmaster@example.com
VSFTP server will use the key and certificate created above.
Step 3: Configuring Pure-FTPD to use SSL/TLS
Now that you’ve generated the server private key and certificate files, go and configure Pure-FTPD to use the SSL/TLS certificate created above. To do that, run the commands below as root (sudo bash) to force Pure-FTPD to communicate over TLS.
echo "2" > /etc/pure-ftpd/conf/TLS
Step 3: Restart Pure-FTPD Server
After adding the highlighted lines to the file, save it. Then run the commands below to restart Pure-FTPD server.
sudo systemctl restart pure-ftpd
Now grab your favorite FTP client (FileZilla) and setup a new site in your site manage and use FTP protocol with encryption with explicit FTP over TLS. Type your username and password and connect.

You should be prompted with a certificate. accept the certificate and continue. You may check the box at the bottom of the page to trusted the certificate so you don’t get prompted in the future.

You should now be transferring files securely via SSL/TLS.

Enjoy!
You may also like the post below:
How configure Pure-FTP with implicit SSL ?