Implicit vs Explicit Security
FTP over TLS (FTPS) supports two security modes: Implicit and Explicit. Both methods encrypt communication between an FTP client and server, but they start the encryption process differently.
Implicit FTPS begins encryption immediately when the connection starts.
Explicit FTPS (also known as FTPeS) begins as a plain FTP session and upgrades to encryption after negotiation.
Files.com supports both types of connections but we strongly recommend using Explicit (FTPeS). Explicit (FTPeS) mode is more flexible, modern, and compatible with a wide range of clients and network configurations.
Implicit
Implicit FTPS establishes encryption from the very start of the connection. The client is expected to begin communication by sending a TLS ClientHello message, and the server immediately requires this handshake. If the server does not receive it, the server closes the connection.
Historically, administrators used implicit FTPS on well-known ports:
990/TCP for the control channel989/TCP for the data channel
This approach allowed older FTP clients to continue using port 21 for standard, unencrypted FTP. However, implicit FTPS was never officially defined in RFC 4217 and is now considered deprecated.
Modern systems, including Files.com, favor Explicit FTPS (FTPES) because it uses the standard FTP command structure and operates more smoothly with firewalls and NAT devices.
When connecting to Files.com using Implicit FTPS use Port 990 (default) or 3990 (alternative Files.com port).
Explicit
Explicit FTPS, or FTPeS, starts as a regular FTP session on the standard FTP ports (typically 21). The client must explicitly request encryption by sending the AUTH TLS command. Once the server agrees, both systems negotiate a secure TLS session for the remainder of the connection.
This model gives administrators flexibility. Servers can allow both encrypted and unencrypted connections on the same port, depending on configuration and client support.
The Explicit FTPS approach is officially defined in RFC 4217 and builds on earlier security extensions introduced in RFC 2228. Together, these standards define the commands used to negotiate encryption:
AUTH TLS- requests to start a TLS-secured sessionAUTH SSL- an older variant rarely used todayFEAT- allows clients to query which security mechanisms a server supports
Files.com requires FTPS clients to negotiate using AUTH TLS, ensuring compatibility with all modern FTP clients and adherence to secure, up-to-date standards.
When connecting to Files.com using Explicit FTPS (also referred to as FTPeS), use Port 21 (default) or 3021 (alternative Files.com port).