Add Let's Encrypt SSL to vsFTPd

In a default vsFTPd installation, the service can only be used without encryption because no SSL certificate is configured. In this article, we will show you how to configure a Let's Encrypt SSL certificate on a vsFTPd server. 

Install Let's Encrypt and generate the certificate

To install Let's Encrypt, we need to install certbot:

# apt-get update
# apt-get install certbot

Once it is installed, we can generate the SSL certificate. If you do not have your own domain, you can use the hostname assigned to the server by Clouding.

To find your server's hostname, open the client panel and under "Mis Servidores", click the server on which you are installing the SSL certificate for vsFTPd. 

Under "Ajustes", find the "Cómo acceder al servidor" section and copy the value shown under "Nombre de Host", as shown in the following image.

Now that we have the server's hostname or our own domain, return to the server and run the following command to generate the certificate:

# certbot certonly --standalone --preferred-challenges http -d 6285b40d-8fcf-444a-8c4b-bb62ff55021a.clouding.host

In "-d 6285b40d-8fcf-444a-8c4b-bb62ff55021a.clouding.host", replace the example hostname with your server's hostname.

The process will ask you for an email address to send you notifications about urgent renewals or security issues. When prompted to accept the terms of service, enter "A" to accept them  and finally enter "N" to prevent your email address from being shared.

If everything worked correctly, you will see a message like this:

IMPORTANT NOTES:

 - Congratulations! Your certificate and chain have been saved at:

   /etc/letsencrypt/live/6285b40d-8fcf-444a-8c4b-bb62ff55021a.clouding.host/fullchain.pem

   Your key file has been saved at:

   /etc/letsencrypt/live/6285b40d-8fcf-444a-8c4b-bb62ff55021a.clouding.host/privkey.pem

   Your cert will expire on 2020-10-20. To obtain a new or tweaked

   version of this certificate in the future, simply run certbot

   again. To non-interactively renew *all* of your certificates, run

   "certbot renew"

We now have our Let's Encrypt SSL certificate and can configure vsFTPD to use it for TLS connections.

Configure vsFTPD with the Let's Encrypt SSL certificate

To configure TLS in vsFTPd, edit the following file:

# vi /etc/vsftpd.conf

Find the following lines.

rsa_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
rsa_private_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
ssl_enable=NO

Now we need to edit the "path" values of the variables "rsa_cert_file and rsa_private_key_file" to use the certificate created by Let's Encrypt. We also need to set the "ssl_enable" variable to "yes"

The paths we need are as follows:

/etc/letsencrypt/live/hostname/cert.pem
/etc/letsencrypt/live/hostname/privkey.pem

 The previous lines should therefore look like this:

rsa_cert_file=/etc/letsencrypt/live/6285b40d-8fcf-444a-8c4b-bb62ff55021a.clouding.host/cert.pem
rsa_private_key_file=/etc/letsencrypt/live/6285b40d-8fcf-444a-8c4b-bb62ff55021a.clouding.host/privkey.pem
ssl_enable=YES

Finally, restart the vsFTPd server to load the new configuration:

# service vsftpd restart

Connect to vsFTPD using TLS from Filezilla

To connect to our vsFTPd server using TLS, open Filezilla and click "Gestor de Sitios"

Add a new site and, in the server field, enter the hostname used earlier. For encryption, select "Requiere FTP explícito sobre TLS".

Click "Opciones de Transferencia", select "Pasivo" mode, and finally click "Conectar".

Enter the password for your FTP user. 

Filezilla will display the SSL certificate generated earlier. Review it and click "Aceptar". 

Finally, you will see that the TLS connection was established successfully. 

 Have you tried it? Leave us your comments! 🙂