Cerberus FTP Server Certificate Self Signed vs Real Certificate Guide
Self signed encrypts but warns. A real certificate encrypts and proves identity. Choose based on who connects, not on habit.
Technical AnshuWindowsSelf signed limits and real certificate setup
Watch - the Cerberus install in the video, then choose the right certificate with this page
Every FTPS setup reaches the same question - the server needs a certificate, Cerberus offers to move fast with a self signed one, and every client then shows a warning. Is that warning a problem or not? The honest answer is it depends on who connects. This page explains what a certificate proves, where self signed is genuinely fine, and where only a real certificate will do.
FTP Client - Certificate Warning, Example Wording
The server certificate is unknown / self signed.
Fingerprint: example values only - compare before trusting
Action: Trust once on a trusted network, or install a real certificate
Self signedEncrypted, warning shown
Real certificateEncrypted, no warning for matching name
Example warning wording. A self signed certificate still encrypts - the warning is about identity, not encryption strength. Fingerprints shown anywhere must be compared, never blindly accepted from an untrusted network.
1
What the Certificate Actually Does
For FTPS and HTTPS, the certificate does two jobs. It enables the TLS encryption that protects passwords and files, and it proves the server identity - that the client really reached your server and not an impostor. A self signed certificate does the first job fully and the second job weakly, because the client has no independent way to know the certificate is yours. A certificate from a trusted authority, matched to a proper hostname, does both jobs. That distinction - encryption versus identity - is the honest heart of this page.
2
When a Self Signed Certificate Is Acceptable
A small office LAN where you personally set up every client and can confirm the fingerprint once, in person or by phone, on a trusted network.
A test or learning setup that will never carry real office files across the internet.
Cerberus can generate or use a self signed certificate to get FTPS running immediately. That is a legitimate starting point - as long as everyone understands users will see a warning and must not be trained to ignore warnings generally.
Never teach staff to click through certificate warnings on other websites because your own server trained them to. That habit is the real cost of self signed on a larger team.
3
When You Need a Real Certificate
Any server used by external clients, auditors or partners - their clients will warn, their IT teams will object, and some will refuse the connection entirely.
Any setup with a public hostname such as ftp.example.com - get a certificate for that exact name from a trusted authority, free automated options exist for many cases as well as paid ones.
Any compliance driven environment. Auditors ask how identity is verified, and a self signed answer rarely satisfies them.
Install the certificate and its private key in Cerberus certificate settings for the FTPS and HTTPS listeners, confirm the hostname matches what clients type, restart the listeners as prompted, and test from a fresh client profile that shows no warning.
4
SFTP Is Different - Host Keys, Not Certificates
If users connect by SFTP, there is no TLS certificate prompt. SSH shows a host key fingerprint instead, which plays the same identity role. The first connection asks the user to trust the key; later connections warn loudly if the key changes. A changed key after a server reinstall is expected - tell users in advance. A changed key with no reinstall is a stop and investigate event. Do not let anyone normalise ignoring that warning either.
5
Renewal and Expiry - the Boring Part That Breaks Servers
Real certificates expire. An expired FTPS certificate produces failed connections or alarming warnings on a random morning months after a perfect setup. Note the expiry date in your diary with a reminder well before it, and after any renewal, test FTPS and HTTPS again from a client. Self signed certificates expire too - Cerberus will not warn your users in advance, you have to track it yourself. Boring, scheduled, and exactly the kind of admin habit that separates a demo server from a production one.
Short honest version - self signed encrypts your files but cannot prove your server identity to strangers. Fine for a small trusted LAN with confirmed fingerprints. For the internet, external users or audits, use a real certificate matched to your hostname.
Watch the Complete Video Guide
The video gets Cerberus encrypted quickly - this page helps you decide if the quick certificate is enough for your users.
Does a self signed certificate encrypt FTPS traffic
Yes. A self signed certificate enables full TLS encryption for passwords and files. What it cannot do is prove server identity to a client automatically, which is why clients show an unknown certificate warning until the fingerprint is confirmed and trusted.
What name should a real certificate for Cerberus cover
The exact hostname clients connect to, such as the public FTP hostname you give users. If clients connect by a name the certificate does not list, they will still see a name mismatch warning even with a real certificate.
Does SFTP in Cerberus need a certificate
No. SFTP uses SSH host keys instead of TLS certificates. Clients confirm the host key fingerprint on first connection and warn if it changes later. Manage that fingerprint like a certificate - announce reinstalls that legitimately change it.
This guide is based on the Technical Anshu video - Install Cerberus FTP Server in 5 Minutes - Stuck on a step, ask in the video comments and you will get an answer there