Choosing Between Implicit and Explicit FTPS in FileZilla for Secure Transfers

Problem: Unclear FTPS mode choice leads to connection failures

When setting up a secure FTP transfer with FileZilla, administrators often see either a timeout after the initial greeting or a certificate warning that blocks the session. The root cause is frequently a mismatch between the client’s FTPS mode (implicit or explicit) and what the server expects.

Thesis: Matching the FTPS mode to the server’s configuration and your network constraints avoids most handshake issues

Understanding the two FTPS modes

FileZilla can operate FTPS in two ways:

• Implicit FTPS – the client assumes TLS is required from the first byte and connects to port 990. The TLS handshake starts immediately; no AUTH TLS command is needed.
• Explicit FTPS – the client first speaks plain FTP on port 21, then sends AUTH TLS to upgrade the connection. After the server replies with 234, the client issues PROT P to protect the data channel.

Worked example: Configuring an explicit FTPS site

1. Open FileZilla → File → Site Manager.
2. Click New Site, name it example-ftps.
3. In the General tab set Host to ftps.example.com, Port to 21 (default for explicit).
4. Choose Protocol → FTP - File Transfer Protocol.
5. Set Encryption to Require explicit FTP over TLS.
6. Under Logon Type select Normal and fill in username and password.
7. Click Transfer Settings → Transfer mode → Passive (adjust if your firewall prefers active).
8. Press Connect. FileZilla will show in the log: Command: AUTH TLS, Response: 234 AUTH TLS successful, then Command: PROT P.

If the log stops after Response: 220 (the plain FTP banner) and you see a timeout, the server likely expects implicit FTPS. Switch the encryption to Require implicit FTP over TLS and change the port to 990.

Trade‑off and limitation

Implicit FTPS simplifies client configuration because the port is fixed and TLS starts immediately, but it uses a non‑standard port (990) that many firewalls block by default. Explicit FTPS works on the familiar FTP port (21) and is easier to allow through NAT, yet it requires an extra round‑trip for the AUTH TLS exchange, which can add latency on high‑delay links.

How to verify the chosen mode works

• After a successful connection, open View → Message log and confirm the sequence described above matches the mode you selected.
• For a deeper check, run Wireshark on the client machine, filter tcp.port == 21 (explicit) or tcp.port == 990 (implicit), and verify that the first packet after the TCP SYN is a TLS Client Hello (implicit) or an FTP AUTH TLS command (explicit).
• Check certificate validation: go to Edit → Settings → Connection → FTP → FTPS. Ensure Ask for confirmation is selected; note the SHA‑256 fingerprint shown when you accept a certificate and compare it with the fingerprint provided by your server administrator.

Actionable closing

Start by asking the server administrator which FTPS mode they support and which port is open in the firewall. Configure FileZilla accordingly using the steps above, then validate the TLS handshake in the message log or with a packet capture. If you encounter certificate warnings, do not switch to “Accept all certificates”; instead obtain the server’s CA certificate and import it into FileZilla’s trusted store. This approach gives you a secure, predictable file‑transfer channel without sacrificing compatibility.