Enable FTPS on Windows IIS FTP Server with SSL Certificate
Plain FTP reads like a postcard. FTPS wraps the same FTP in TLS encryption — and on IIS it takes one certificate and one policy setting, done in the right order.
🎥 The full deployment is in the video — the FTP feature install, users, folder permissions, firewall and passive mode, shown live step by step
Everything in this series repeats one fact: classic FTP sends the password and the data in plain text. FTPS is the fix that keeps your existing IIS site, users and folders, and adds TLS encryption — the same technology that secures HTTPS. The steps are simple, but the order matters: certificate first, then the site's SSL policy, then the client setting. And one firewall consequence catches everyone out — it is covered honestly below.
FTP SSL Settings — The Policy That Switches Encryption On
SSL certificateftp.office.local (example)
SSL policyRequire SSL connections
Control channelEncrypted
Data channelEncrypted
Require SSL is the setting that matters — Allow SSL still lets plain-text logins through the same door.
1
Step 1 — Get or Create the Certificate
FTPS needs an SSL certificate installed on the server, in IIS Manager → the server node → Server Certificates.
Internal LAN only: Create Self-Signed Certificate is acceptable — traffic is encrypted, but clients will warn that the identity is unproven, and users must verify it is really your server's certificate.
Real use beyond your office: use a certificate from a proper certificate authority matching the name clients connect to, such as ftp.yourcompany.com. No warnings, and the identity is proven.
Be honest with yourself about the difference: a self-signed certificate stops casual reading of passwords; it does not stop a determined impersonator. Encryption without identity is half the job.
2
Step 2 — Bind the Certificate and Require SSL
Select the FTP site → FTP SSL Settings.
Choose the certificate from the dropdown.
Set the SSL policy to Require SSL connections. The Allow option keeps plain FTP working side by side — useful for a one-week migration, wrong as a final state.
Apply, then restart the site. From this moment a plain FTP client that cannot do TLS will fail to log in — that is the point.
3
Step 3 — Connect the Client the FTPS Way
In FileZilla's Site Manager, set the protocol to FTP – File Transfer Protocol and encryption to Require explicit FTP over TLS, keeping port 21. Explicit FTPS starts as a normal connection and upgrades to TLS before the password is sent. (The older implicit style uses port 990; IIS supports explicit as the modern standard.) The first connection shows the certificate for approval — check its name matches your server before accepting, and teach users to do the same.
4
Step 4 — The Firewall Consequence Nobody Warns You About
With plain FTP, Windows Firewall's stateful FTP inspection can peek at the control channel and open data ports dynamically. With FTPS the control channel is encrypted, so the firewall can no longer peek — which means the dynamic trick stops working and your fixed passive port range becomes mandatory: set it in FTP Firewall Support, open it in Windows Firewall, and forward it on the router if clients are external. Every step is in the passive-mode page of this series. If FTPS logins work on the LAN but listings hang from outside, this is why.
5
Step 5 — Prove It Is Actually Encrypted
Connect with FileZilla and confirm the log shows TLS initialised and the padlock appears in the status bar.
Try a plain FTP connection on purpose — it must now be refused. A security setting you have not tried to break is a hope, not a setting.
Note the certificate expiry date in your admin diary. An expired certificate is the number one reason a working FTPS server suddenly rejects everyone a year later.
🔴 One rule before anything else: classic FTP sends the username, the password and every file in plain readable text. Inside a trusted office LAN it still has honest uses. On the open internet it does not — there the answer is FTPS or SFTP, and these pages will keep saying so.
🎥 Watch the Complete FTP Server Deployment
The video sets up the whole FTP server on Windows live — including the fast automated route — so you can follow it on your own server, click by click.
No — they are different protocols that happen to solve the same problem. FTPS is classic FTP wrapped in TLS and lives in IIS. SFTP is a subsystem of SSH on a single port 22 and needs an SSH server such as OpenSSH. The comparison page in this series lays out which to choose.
Will my existing FTP users and folders keep working after enabling FTPS
Yes. FTPS changes only how the connection is protected. Users, passwords, authorization rules and folders stay exactly as they were — clients just need the TLS setting switched on.
My scanner or old device cannot do FTPS — what now
Keep a separate plain FTP site bound only to the internal LAN for that device, with its own limited user and folder, and put everything else on FTPS. One weak device should not drag the whole server back to plain text.
This guide is based on the Technical Anshu video — Windows FTP Server Deployment Guide for IT Admins • Stuck on a step — ask in the video comments and you will get an answer there 🙏