How to Generate a CSR on Titan SFTP Server

This tutorial shows you how to generate a CSR on Titan SFTP Server. How you reach the certificate tools depends on which administration console your installation uses, and this is the detail worth getting right before you start.

Recent releases (the NextGen line) manage certificates from a browser-based Administrator Console that you open at an address such as https://your-server:41443. Earlier and desktop-managed installations use the classic Windows Titan FTP Server Administrator. The two consoles put the certificate tools under different menus, so the steps below cover the current browser console first, then the classic desktop console in its own section near the end.

Either way, Titan’s built-in wizard can produce a CSR for a publicly trusted certificate as well as a self-signed certificate for testing, and the certificate you install serves both FTPS and the HTTPS web interface.

Generate a CSR on Titan SFTP Server

If you have already generated your CSR and received the signed certificate from your CA, skip ahead to installing an SSL certificate on Titan SFTP Server.

You have two options:

• Use our CSR Generator to create the CSR and private key on your own machine, then copy both files to the Titan server.
• Follow the steps below to create the CSR inside Titan, which keeps the private key on the server that will use it.

Step 1: Open the certificate tools

1. Sign in to the Titan Administrator Console in your browser and select the server you want to secure in the left navigation.
2. Click Services, then open the FTPS/SSL tab.
3. Click Manage Certificates to open the certificate list, then click New to start the certificate wizard. (The neighboring Import button is for loading a certificate you already have, not for creating one.)

Titan keeps one certificate store for the whole server, so the same list appears whether you reach it from the FTPS/SSL tab or the HTTP/HTTPS tab. A certificate you create here can be assigned to either service.

Step 2: Fill in the certificate details

The wizard asks for the identity fields that make up the certificate subject. Enter them as follows:

• Common Name: the fully qualified domain name (FQDN) clients use to reach the server, for example ftp.yoursite.com. For an FTP server this is often not the same hostname as your website, so use the name your FTPS and web users actually connect to. For a wildcard certificate, put an asterisk in front of the domain, as in *.yoursite.com.
• Organization: the full legal name of your company, for example Your Company LLC. For a personal or domain-validated certificate, enter the name the domain is registered to.
• Department (Organizational Unit): the CA/Browser Forum retired this field in September 2022, and it is no longer allowed in publicly trusted TLS certificates. Leave it blank; the CA will drop it either way.
• Locality/City: the full city name where your organization is based, for example San Francisco. Do not abbreviate it.
• State/Province: the full name of the state or province where your organization is registered, for example California, spelled out rather than abbreviated.
• Country: select your country, or enter its two-letter ISO 3166-1 code, such as US, GB or CA.
• Email Address: a valid contact address. It has no effect on issuance, since the CA reaches you through the contact details on your order rather than through the CSR.

If the wizard shows Valid From and Valid To fields, ignore them. Titan displays placeholder dates, but your CA sets the real validity period when it issues the certificate.

Type these carefully, but do not agonize over them. The CA builds the certificate subject from its own validation records, not from your CSR. On a domain-validated certificate, none of the organization, locality or state values appear in the issued certificate at all. On an organization-validated or extended-validation certificate they do appear, but only after the CA confirms them against official records, so a typo here is corrected during validation rather than baked into the certificate.

Step 3: Choose the key size

Set the key length before you generate the request. 2048-bit RSA is the default and the minimum a public CA will accept, and it is the right choice for most FTP servers. You can move to 3072 or 4096 bits if your own security policy requires it, keeping in mind that larger RSA keys add handshake time on a busy transfer server. If your build offers ECDSA, it gives smaller keys and faster handshakes, but stay on the NIST curves P-256, P-384 or P-521, since no other curve is allowed in publicly trusted certificates, and pick it only when you know the clients connecting to your server support it.

Step 4: Protect the private key with a password

If Titan prompts you, create and confirm a password for the private key. This encrypts the key file at rest, which is good practice on a server that accepts external connections. Record the password in your password manager before you continue, because Titan cannot recover it and you will be asked for it when you import the issued certificate. If you would rather not set one, leaving it blank produces an unencrypted key.

Step 5: Generate the CSR

On the final page, choose to send the certificate to a CSR for signing rather than self-signing it. Self-signing produces a certificate that clients do not trust, which is fine for internal testing but not for users who need to connect without warnings. Confirm the choice and save the request. Titan produces two items: the CSR itself (a .csr file, which you submit to your CA) and the matching private key (a .pem file), which stays on the server. Depending on the console, Titan either writes both to a folder you choose or offers the CSR for download while keeping the key on the server, so note where each one goes and make sure you can find the key again.

Step 6: Send the CSR to your CA

Open the CSR file with any text editor, such as Notepad, and copy everything, including the first and last lines:

-----BEGIN CERTIFICATE REQUEST-----
(base64-encoded data)
-----END CERTIFICATE REQUEST-----

Paste that text into the CSR box on your SSL vendor’s order form. When the form asks which server software you use, choose Other, since Titan is rarely listed by name. Before you submit, run the text through our CSR Decoder to confirm the Common Name, key type and key size came out the way you intended. Catching a mistake here takes a minute; catching it after issuance means a reissue.

Leave the private key where Titan saved it. It never goes to the CA, it must stay on the server, and you will point Titan at it, together with its password, when the signed certificate arrives. Back it up somewhere safe as well, following our guidance on private key storage. If the key is lost, the issued certificate is useless and you have to start again with a new CSR.

Generating a CSR in the classic Titan FTP Server Administrator

If you administer Titan through the classic Windows desktop console rather than the browser-based Administrator Console, the certificate tools live under a different menu, but the wizard collects the same details.

1. Open the Titan FTP Server Administrator and, in the left pane, expand to the server you want to secure and log in.
2. Expand Your Domain > Your Server and click Security.
3. Click Certificate Management. In the Certificate Manager window that opens, click Create.
4. In the SSL Certificate Wizard, fill in the same identity fields described above (Common Name, Organization, Locality/City, State/Province, Country and Email Address), leaving the deprecated Department field blank, then click Next.
5. Set the Key Length to 2048 bits (or larger) and click Next.
6. Create and confirm a password to protect your private key, and remember it for installation.
7. Select Generate CSR for signing by a Trusted Certificate Authority, click the three-dot button to choose a folder for the .csr file and the .pem private key, then click OK and close the Certificate Manager.

From here the process is identical: open the .csr file, copy its contents, and submit it to your CA as described in Step 6.