Add Let's Encrypt SSL to ProFTPd

In a default installation of ProFTPd, we can only use the service without encryption because it does not have an SSL certificate configured. In this article, we will show you the steps to configure a Let's Encrypt SSL certificate on a ProFTPd server. 

Installing Let's Encrypt and generating the certificate

To install Let's Encrypt, we need to add the repository and install certbot:

# apt update && apt install certbot -y

Once installed, we can generate the SSL certificate. If you do not have your own domain, you can use the hostname assigned to the server by Clouding.

To find our server's hostname, we access the client panel and under "Mis Servidores", click the server on which we are installing the SSL certificate for ProFTPd. 

Under "Ajustes", we have the "Cómo acceder al servidor" section, where we copy the value shown under "Nombre de Host", as you can see in the following image.

Now that we have the server's hostname or our own domain, we return to our server and run the following command to generate the certificate:

# certbot certonly --standalone --preferred-challenges http -d 3e093052-6120-46fc-900b-270910d1233b.clouding.host

In "-d 3e093052-6120-46fc-900b-270910d1233b.clouding.host", you need to replace the example hostname with your server's hostname.

If a Web server is already installed, standalone will fail. In that case, see the following article: How to obtain Let's Encrypt certificates with Certbot.

The process will ask you for an email address to send you notifications about urgent renewals or security issues. At the terms of service prompt, we enter "A" to accept them  and finally enter "N" so that our email address is not shared.

If everything has worked correctly, you will see a message like this:

IMPORTANT NOTES:

 - Congratulations! Your certificate and chain have been saved at:

   /etc/letsencrypt/live/3e093052-6120-46fc-900b-270910d1233b.clouding.host/fullchain.pem

   Your key file has been saved at:

   /etc/letsencrypt/live/3e093052-6120-46fc-900b-270910d1233b.clouding.host/privkey.pem

   Your cert will expire on 2020-10-20. To obtain a new or tweaked

   version of this certificate in the future, simply run certbot

   again. To non-interactively renew *all* of your certificates, run

   "certbot renew"

We now have our Let's Encrypt SSL certificate and can proceed to configure ProFTPd to use it for TLS connections.

Configure ProFTPd with the Let's Encrypt SSL certificate

To configure TLS in proFTPd, we will edit the following file:

# vi /etc/proftpd/tls.conf

Then we uncomment the following lines.

TLSEngine                               on
TLSRSACertificateFile                   /etc/ssl/certs/proftpd.crt
TLSRSACertificateKeyFile                /etc/ssl/private/proftpd.key
TLSCACertificateFile                    /etc/ssl/certs/CA.pem
TLSOptions NoCertRequest EnableDiags NoSessionReuseRequired

Now we need to edit the "path" values of the variables "LSRSACertificateFile, TLSRSACertificateKeyFile and TLSCACertificateFile" to use the certificate created by Let's Encrypt.

The paths we will need are as follows:

/etc/letsencrypt/live/hostname/cert.pem
/etc/letsencrypt/live/hostname/privkey.pem
/etc/letsencrypt/live/hostname/chain.pem

 We will therefore set the previously uncommented lines as follows:

TLSEngine                               on
TLSRSACertificateFile              /etc/letsencrypt/live/hostname/cert.pem
TLSRSACertificateKeyFile           /etc/letsencrypt/live/hostname/privkey.pem
TLSCACertificateFile               /etc/letsencrypt/live/hostname/chain.pem

For ProFTPd to import this configuration file, we need to edit the following file:

# vi /etc/proftpd/proftpd.conf

Then we uncomment the following line:

Include /etc/proftpd/tls.conf

Finally, we restart the ProFTPd server to load the new configuration:

# service proftpd restart

Connect to ProFTPd with TLS from Filezilla

To connect to our ProFTPd server using TLS, we open Filezilla and click "Gestor de Sitios"

We add a new site and specify the previously used hostname in the server field. For encryption, we select "Requiere FTP explícito sobre TLS".

We click "Opciones de Transferencia", select "Pasivo" mode and finally click "Conectar".

We enter the password for our FTP user. 

Filezilla will show us the SSL certificate generated earlier. We review it and click "Aceptar". 

Finally, we will see that the TLS connection has been established successfully. 

 Have you tried it? Leave us your comments! 🙂