FTP Secure (FTPS)

FTP Secure is the File Transfer Protocol protected by TLS, described for the explicit form in RFC 4217 (2005). Client and server keep FTP’s commands and its separate control and data connections, but both can be encrypted, so credentials and file contents no longer cross the network in cleartext, and the server commonly authenticates with a certificate. In explicit mode the client connects on the normal FTP control port and asks to upgrade to TLS; in the older implicit mode, TLS starts as soon as the connection opens on a port set aside for it.

The comparison that matters is with SFTP. SFTP is not FTP at all: it is a file transfer protocol that runs over SSH on a single connection. FTPS keeps FTP’s two-connection design, and with it FTP’s difficulty with firewalls: once the control channel is encrypted, a firewall can no longer read the data ports the two ends negotiate, so a range of ports usually has to be opened in advance. Its certificates come from the public key infrastructure.

Exam relevance: questions in this area tend to turn on the underlying protocol. FTP over TLS with certificates points to FTPS; file transfer over SSH points to SFTP. Candidates are expected not to treat the two as the same thing with different names.