I have an Ubuntu 16.04.3 AWS EC2 instance running vsftpd 3.0.3. Plain FTP works just fine, but I need to enable TLS so my clients can use sftp to upload files.

I have researched this for hours, but everything I find shows how to configure a self-generated certificate. I want to use my wildcard SSL certificate that was purchased from GoDaddy. (the same one I'm using on my AWS Elastic Load Balancer).

I have the .key file, and the two .crt files that I downloaded from GoDaddy. I can't figure out how to put those three files in a format that vsftpd can understand. I get no errors from vsftpd, but when I connect using FileZilla I get this response:

Status: Connecting to <my ftp subdomain>.<my domain>.com...
Status: Skipping non-existing key file "C:\Users\<some local file1>.ppk"
Status: Skipping non-existing key file "C:\Users\<some local file2>.ppk"
Status: Skipping non-existing key file "C:\Users\<dome local file3>.ppk"
Response:   fzSftp started, protocol_version=8
Command:    open "<username>@<my ftp subdomain>.<my domain>.com" 22
Error:  Disconnected: No supported authentication methods available (server sent: publickey)
Error:  Could not connect to server

I have already confirmed that port 22 is open in the firewall.

BTW, my ultimate goal is for clients to connect without getting any sort of "do you trust this certificate" message during their first connection. Please tell me if I'm on the wrong track.


For port 22, you're typically using SFTP and not FTPS. The difference is FTPS uses an SSL public/private key pair to secure the FTP transactions and still requires you to authenticate via username and password. With SFTP you're using a public/private keypair you generate yourself and is tied to a specific user to use for authentication. The public key is stored in the vsftp server for the user while the client you're connecting from presents the server with the private key. I think your issue is that the two are being confused as the error logs are looking for ppk files to present to the server for authenticating the user.

To clarify for you, port 22 is already open through the EC2 instance so you actually don't need vsftp, but instead just use the private key provided by AWS when you created the instance and you should be good. You don't want to use vsftp to use port 22 as then you will have no way to ssh into your instance without changing the port SSH runs on. the OpenSSH server that's there by default already gives you sftp functionality. If you specifically want to use FTPS then you'll need to connect to the port you defined in your vsftp configuration and open up any necessary firewall ports in the security group the EC2 instance uses.

| improve this answer | |

OK, it took a while, but I finally got all of the pieces put together and it works now!

  1. I had to concat my certificate, key, and intermediate certs into a single .pem file as described here: http://www.terminalinflection.com/solaris/vsftpd-configuration/
  2. Then I had to setup the sftp subsystem of sshd as described in this EXCELLENT article: https://www.thegeekstuff.com/2012/03/chroot-sftp-setup/
  3. Add the following to my vsftpd.conf file:


Now I can use plain ftp for my old users, while requiring sftp for my new users.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.