Building the Fullchain File with the copy Command

FileZilla Server reads the chain from the same file as the SSL Certificate, so concatenate the issued SSL Certificate and the ca-bundle into one file with your own SSL Certificate first, which the Windows copy command joins cleanly. Skipping this step leaves the server presenting a bare SSL Certificate, and strict FTP clients then warn about an incomplete chain even though everything else is correct.

Key Mismatch and Chain Warning Diagnosis

A settings save rejected over a key mismatch means the Private Key does not pair with the SSL Certificate, usually because the Certificate Signing Request (CSR) was regenerated after submission, and a reissue against the current Certificate Signing Request (CSR) resolves it. Chain warnings in strict clients mean the bare SSL Certificate was configured instead of the fullchain file.

Installing an SSL Certificate on a FileZilla Server

Q: Configuring FTP over TLS with an Existing SSL Certificate

In the FTP over TLS configuration area, choose the option to use an existing SSL Certificate file rather than the built-in self-signed generator, pointing the SSL Certificate path at the fullchain file and the key path at the Private Key. The server begins offering secured connections immediately, with explicit TLS on the standard port 21 and implicit TLS conventionally on port 990.

Q: Requiring TLS for Every Login

Requiring Transport Layer Security (TLS) for every login, an option in the same settings area, turns the SSL Certificate from decoration into policy. Plain unencrypted logins otherwise remain possible, sending passwords across the network in the clear.

June 13, 2026 James Rodriguez

FileZilla Server secures file transfers through File Transfer Protocol (FTP) over Transport Layer Security (TLS), and a publicly trusted SSL Certificate is what saves every connecting user from manually accepting an unknown one. The installation is short, with one preparation step doing most of the work, because the server reads the chain from the same file as the SSL Certificate.

Prerequisites and Required Files

You need access to the machine running FileZilla Server and its administration interface. You also need your issued SSL Certificate, the ca-bundle of Intermediate Certificates from the Certificate Authority (CA), and the Private Key generated with your Certificate Signing Request (CSR), all in PEM format.

The first two are available in the tracking system at any time. View Our Tracking & SSL Management 🔗

Building the Fullchain File

Concatenate the issued SSL Certificate and the ca-bundle into one file, with your own SSL Certificate first. On Windows, the copy command joins text files cleanly.

copy /b yourdomain.crt + yourdomain.ca-bundle yourdomain-fullchain.crt

Skipping this step leaves the server presenting a bare SSL Certificate, and strict FTP clients then warn about an incomplete chain even though everything else is correct. Learn About Intermediate Certificates 🔗

Place the fullchain file and the Private Key in a protected directory the server account can read.

Configuring FTP over TLS

Open the administration interface, enter the server settings, and locate the FTP over TLS configuration area. Choose the option to use an existing SSL Certificate file rather than the built-in self-signed generator.

Point the SSL Certificate path at the fullchain file and the key path at the Private Key, provide the key password if one was set, and save. The server begins offering secured connections immediately, with explicit TLS on the standard port 21 and implicit TLS conventionally on port 990.

Tip : Requiring TLS for every login, an option in the same settings area, turns the SSL Certificate from decoration into policy. Plain unencrypted logins otherwise remain possible, sending passwords across the network in the clear.

With the paths saved and the policy decided, the result is ready to test.

Verifying the Installation

Connect with an FTP client configured for explicit TLS and inspect the SSL Certificate the server presents, confirming your hostname, the public chain, and the expiry date. A client that connects silently with no trust prompt is the practical proof of success, since prompts are exactly what the public SSL Certificate eliminates.

Test from a machine that has never connected before if possible, because a client that previously accepted the old self-signed entry may stay quiet for the wrong reason.

Troubleshooting Common Installation Problems

A settings save rejected over a key mismatch means the Private Key does not pair with the SSL Certificate, usually because the Certificate Signing Request (CSR) was regenerated after submission. A reissue against the current CSR resolves it. Learn About Reissuing Your SSL Certificate 🔗

Chain warnings in strict clients mean the bare SSL Certificate was configured instead of the fullchain file. Build the combined file, repoint the path, and save.

Clients connecting but failing on directory listings or transfers are usually blocked at the firewall rather than the SSL Certificate, since secured FTP needs its passive port range open alongside the control port. Configure a passive range in the server settings and open it on the firewall.

Professional Installation Assistance

FTP deployments mix SSL Certificate configuration with passive mode and firewall behavior, and the interaction is where most of the frustration lives.

Trustico® offers a Premium Installation service where our technicians complete the installation on your behalf. Discover Our Premium Installation Service 🔗

Back to Blog

Stay Updated - Our RSS Feed

There's never a reason to miss a post! Subscribe to our Atom/RSS feed and get instant notifications when we publish new articles about SSL Certificates, security updates, and news. Use your favorite RSS reader or news aggregator.

Subscribe via RSS/Atom

Item Added to Cart