tls.conf

# adapt this file to match your needs and bind it as a volume on /etc/proftpd/tls.conf

<IfModule mod_tls.c>
  TLSEngine on

  <IfDefine VERBOSE=ON>
    TLSLog /var/log/proftpd/tls.log
  </IfDefine>

  # Support both SSLv3 and TLSv1
  TLSProtocol SSLv3 TLSv1

  # Are clients required to use FTP over TLS when talking to this server?
  TLSRequired on

  # Server's RSA certificate
  TLSRSACertificateFile /etc/proftpd/certs/proftpd.cert.pem
  TLSRSACertificateKeyFile /etc/proftpd/certs/proftpd.key.pem

  # Server's EC certificate
  # TLSECCertificateFile /etc/proftpd/certs/proftpd-ec.cert.pem
  # TLSECCertificateKeyFile /etc/proftpd/certs/proftpd-ec.key.pem

  # CA the server trusts
  # TLSCACertificateFile /etc/proftpd/certs/proftpd.root.cert.pem

  # Authenticate clients that want to use FTP over TLS?
  TLSVerifyClient off

  # Allow SSL/TLS renegotiations when the client requests them, but
  # do not force the renegotations.  Some clients do not support
  # SSL/TLS renegotiations; when mod_tls forces a renegotiation, these
  # clients will close the data connection, or there will be a timeout
  # on an idle data connection.
  TLSRenegotiate none

</IfModule>