FTPS Certificate Checker

Inspect the TLS certificate of an FTPS server - expiry date, issuer, subject, and whether the certificate is self-signed.

Encryption Mode

Common errors explained

550

SSL/TLS required on the control channel. You are using Implicit mode (port 990) but your server uses Explicit FTPS (AUTH TLS on port 21). Switch the encryption mode to Explicit / STARTTLS and set the port to 21.

TLS

TLS handshake failed / connection refused on port 990. Your server uses Explicit FTPS on port 21, not Implicit on port 990. Switch the mode to Explicit / STARTTLS.

534

Request denied for policy reasons. Same as 550 above - try switching to Explicit mode on port 21.

Not sure which mode your server uses? Try the FTP Port Checker to see which ports are open, or check your server's admin panel.

What does this tool check?

  • Certificate subject - the domain or hostname the certificate was issued for.
  • Subject Alternative Names - additional hostnames or IPs covered by the certificate.
  • Issuer & CA chain - whether the certificate is signed by a trusted Certificate Authority.
  • Expiry date - days remaining before the certificate expires.
  • Key algorithm & size - the public-key type (e.g. RSA) and bit length used by the certificate.
  • Signature algorithm - the hash algorithm used to sign the certificate (e.g. sha256RSA).
  • Serial number - unique identifier assigned by the Certificate Authority.
  • Self-signed flag - whether the certificate is self-signed (common in private FTP setups).
  • Thumbprint - SHA-1 fingerprint for pinning and manual verification.
  • Certificate version - the X.509 version of the certificate (most modern certs are v3).

Check it from the command line

OpenSSL reads the same certificate. It comes with Git for Windows (in Git Bash) and with most Linux and macOS systems. For explicit FTPS on port 21, and for implicit FTPS on port 990:

openssl s_client -connect ftp.example.com:21 -starttls ftp </dev/null | openssl x509 -noout -subject -issuer -dates
openssl s_client -connect ftp.example.com:990 </dev/null | openssl x509 -noout -subject -issuer -dates

The output names who the certificate was issued to, who issued it, and the dates it is valid between. Add -fingerprint -sha256 to the openssl x509 part for a fingerprint to compare.

A self-signed certificate is not a fault in itself - many private servers use one. What matters is that you check its fingerprint once with the server's owner, and that your client tells you when it changes. FTPie shows an FTPS certificate the first time it sees it, and again whenever it changes.