How to Enable TLS for VSFTPD on RHEL-Family Linux

Applies to: RHEL-family Linux — RHEL 6–10 / Rocky Linux 8–10 / AlmaLinux 8–10 / CentOS 6–8 / CentOS Stream 8–10

Traditional FTP sends usernames, passwords, and file data without encryption. If you still need to run vsftpd, you can protect the connection with TLS and use FTPS instead of plain FTP.

Current guidance: For new deployments, prefer SFTP over OpenSSH where possible. Red Hat has deprecated FTP client and server software, including vsftpd, in RHEL 10 and recommends moving new workflows to SFTP or WebDAV.

FTPS and SFTP are different protocols. FTPS is FTP protected with TLS. SFTP is the SSH File Transfer Protocol and does not use vsftpd.

In This Article

• 1. Install VSFTPD
• 2. Prepare the TLS Certificate
• 3. Configure VSFTPD for TLS
• 4. Restart VSFTPD
• 5. Firewall and Passive Ports
• 6. Test the FTPS Connection
• 7. Key Takeaways

1. Install VSFTPD

On current RHEL-family systems:

dnf install vsftpd

On older RHEL 6 / CentOS 6 systems:

yum install vsftpd

You do not need the Apache mod_ssl package to enable TLS in vsftpd. The original version of this article included that step, but mod_ssl is an Apache HTTP Server module and is unrelated to vsftpd TLS support.

2. Prepare the TLS Certificate

For production use, use a certificate issued by your internal PKI or a trusted public CA. For testing, you can create a self-signed certificate:

openssl req -x509 -nodes -newkey rsa:3072 -days 365 \
-keyout /etc/pki/tls/private/vsftpd.key \
-out /etc/pki/tls/certs/vsftpd.crt

Protect the private key so that it is not readable by ordinary users:

chmod 600 /etc/pki/tls/private/vsftpd.key

3. Configure VSFTPD for TLS

Edit:

/etc/vsftpd/vsftpd.conf

Add or update the TLS settings:

ssl_enable=YES
force_local_logins_ssl=YES
force_local_data_ssl=YES

rsa_cert_file=/etc/pki/tls/certs/vsftpd.crt
rsa_private_key_file=/etc/pki/tls/private/vsftpd.key

ssl_sslv2=NO
ssl_sslv3=NO

On current RHEL releases, allowed TLS protocol versions and cryptographic algorithms are also controlled by the operating system’s system-wide crypto policy. RHEL 8 and later disable legacy TLS 1.0 and TLS 1.1 under the default policy, so do not weaken the system crypto policy just to support an old FTP client.

4. Restart VSFTPD

On RHEL 7 and later:

systemctl enable --now vsftpd
systemctl restart vsftpd

On RHEL 6 / CentOS 6:

service vsftpd restart
chkconfig vsftpd on

5. Firewall and Passive Ports

If clients connect through a firewall or NAT device, define a passive port range in vsftpd.conf:

pasv_min_port=50000
pasv_max_port=50100

On systems using firewalld, allow the FTP service and the passive range:

firewall-cmd --permanent --add-service=ftp
firewall-cmd --permanent --add-port=50000-50100/tcp
firewall-cmd --reload

6. Test the FTPS Connection

Use an FTP client that supports explicit FTP over TLS, such as FileZilla. Confirm that:

• The client negotiates TLS before sending credentials.
• The server certificate is trusted or matches the certificate you expect.
• Authentication succeeds.
• Directory listings and file transfers work through the passive port range.

If the control connection works but directory listings or transfers fail, check the passive port range, firewall, and NAT configuration before changing TLS settings.

7. Key Takeaways

• Plain FTP sends credentials and data without encryption.
• VSFTPD can use TLS without installing Apache mod_ssl.
• Use a trusted certificate for production FTPS deployments.
• Do not weaken modern RHEL crypto policies to support obsolete TLS clients.
• For new deployments, prefer SFTP over OpenSSH instead of building a new FTP/FTPS service.

References

• Red Hat – RHEL 10 Deprecated Features
• Red Hat – VSFTPD and TLS Configuration