How to Install an SSL Certificate on Titan SFTP Server

This guide gives you step-by-step instructions on how to install an SSL certificate on Titan SFTP Server, the South River Technologies file transfer server sold for years as Titan FTP Server. It covers both administration consoles, explains how Titan handles intermediate certificates, and shows how to renew later without repeating the whole import.

Check which console you have before you start

This is the detail worth settling first, because the two consoles put the certificate tools in different places and a reader following the wrong set of steps will not find the buttons.

• The NextGen Administrator Console runs in a browser. Launch it with the Titan icon on the server desktop, which opens the console on the default local admin port 31443. This is what current releases use, including Titan SFTP 2026.
• The classic Titan FTP Server Administrator is a Windows desktop application, used by legacy installations.

Administering the server from another machine is a separate setting rather than a second address that is always available: remote administration has to be enabled on the domain, and you choose the URL and port yourself and open that port on any firewall in the way. Because the port is yours to pick, do not assume a number you found in a forum post applies to your install.

The two names are the same product line. South River renamed the server to Titan SFTP Server, and the vendor publishes an upgrade path from Titan FTP 2019 to the current release, so an older box still branded Titan FTP is expected to move onto the newer console rather than stay where it is.

Generate a CSR code on Titan SFTP Server

If you have already generated the CSR code and received the SSL certificate from your CA, skip this part and go straight to the installation steps.

When you apply for a commercial SSL certificate, one of your first steps is to create a Certificate Signing Request (CSR) and send it to your SSL provider for validation. The CSR is a block of text that contains your domain and organization details in encoded form.

You have two options:

• Use our CSR Generator to create the CSR and the private key on your own machine, then copy both to the server.
• Follow our step-by-step tutorial on how to generate a CSR on Titan SFTP Server, which keeps the private key on the server that will use it.

You can open the CSR file with any text editor, such as Notepad. During your SSL certificate order, submit the CSR code to your Certificate Authority.

Install an SSL certificate on Titan SFTP Server

Step 1: Prepare your SSL files

After you receive the SSL certificate from your CA, download the ZIP folder and extract its files. Depending on your provider, you should have the following ready:

• The signed SSL certificate.
• The intermediate SSL certificate (some CAs ship a CA bundle that contains the root and intermediate certificates).
• Your private key, generated together with the CSR.

Titan accepts two formats. You can import PEM files (such as .crt, .pem, or .key) or a single .pfx file (also called PKCS#12). A PFX bundle usually contains everything you need in one file: the certificate, the private key, and the CA chain.

Titan does not force a specific file extension. Whether your certificate ends in .pem, .crt, or .cer, it works as long as it is properly formatted as PEM or PFX.

Step 2: Locate your private key

Find the private key file that was created during CSR generation on the server (or on another system). It is in the directory you specified when you saved your CSR.

If the key is encrypted, you will be prompted for its passphrase during import. If it is unencrypted, leave the password field blank.

Step 3a: Import the certificate in the NextGen Administrator Console

Use this path if your console opens in a browser. Skip to Step 3b if you are on the classic desktop Administrator.

1. Launch the Administrator Console and sign in with your admin credentials.
2. Select the server in the left navigation, then click Services.
3. Open Manage Certificates. The list offers New, Import, Update, Export and Delete. Use Import, not New: New starts a fresh certificate or CSR, which is not what you want with a signed certificate already in hand.
4. Browse to your certificate file and select it. If the private key is protected, enter the private key password when prompted to finish the import.
5. Give the certificate a friendly name you will recognize in the dropdown later, for example the domain plus the expiry year.

Titan keeps one certificate store for the whole server, so a certificate imported here can be assigned to FTPS or to the HTTPS web interface, and you reach the same list from either tab.

Step 3b: Import the certificate in the classic desktop Administrator

1. Open the Titan FTP Server Administrator.
2. Select the domain you want to secure and log in.
3. Expand Your Server > Services > FTPS/SSL, then click Manage Certificates.
4. In the Certificate Management window, click Import.
5. In the Import Certificate window, select the Import my Certificate and Private Key from separate files option. (If you have a single PFX bundle, choose Import my Certificate and Private Key from a single file (PKCS#12) instead and point it at your .pfx file.)
6. Under Certificate filename, click the three-dot button and select your SSL certificate (the .pem or .crt file).
7. Under Private Key filename, click the three-dot button and select your private key (the .key file).
8. Enter the password you set for your private key during CSR generation, then confirm it. Leave it blank if the key has no passphrase.
9. Enter a unique friendly name for your certificate, then click Import.

What about intermediate certificates?

Titan handles intermediates in two ways:

• If you use a .pfx file, it can already contain the full chain, so no extra action is needed.
• If you use separate PEM files, append the intermediate certificates directly after your server certificate in a single file, then select that combined file during import.

To build that combined file on a system with OpenSSL, concatenate the certificate and the CA bundle into one full-chain file:

cat yourdomain.crt yourdomain.ca-bundle > yourdomain_fullchain.crt

On Windows without OpenSSL, open both files in a plain-text editor and paste the intermediate certificate block below your server certificate block, keeping each BEGIN and END line intact. Save the result and select it as the certificate file during import. Use a plain-text editor such as Notepad or Notepad++ rather than Word, which adds hidden characters that invalidate the file.

Step 4: Assign your SSL certificate and enable FTPS

Importing a certificate only adds it to the store. It does nothing until you select it:

1. Return to Services and open the FTPS/SSL tab.
2. From the Certificate dropdown, select the friendly name of your SSL certificate.
3. Confirm that FTPS is enabled and choose your mode to match how your clients connect: Explicit FTP/S (AUTH TLS) allows a TLS-secured connection, while Implicit FTP/S requires one and listens on its own port, 990 by default.
4. Check the TLS Versions setting while you are here and allow only TLS 1.2 and TLS 1.3. Older versions are still selectable and are no longer acceptable on a server reachable from the internet.
5. Click Apply (top right) to save and activate the settings.

If the same hostname also serves the web interface, repeat the selection on the HTTP/HTTPS tab, since the certificate is chosen per service even though the store is shared.

Renewing the certificate later

When the certificate is due for renewal, you do not have to import a second one and re-point every service. In the certificate list, click Update next to the existing certificate and browse to the newer file. The entry keeps its friendly name, so the services already pointing at it continue to work without being reassigned. Certificate lifetimes are getting shorter, so this is worth knowing before the first renewal rather than after it.

Test your SSL installation

After you install the certificate, run a quick check for configuration errors and weak settings. Connect an FTPS client to the server and confirm that the TLS handshake succeeds and that the certificate is presented with its full chain.

You can also confirm the chain from any machine with OpenSSL by connecting to the FTPS port (explicit FTPS on port 21 in this example) and reading the certificate Titan serves:

openssl s_client -connect yourdomain.com:21 -starttls ftp -servername yourdomain.com

Read the certificate list in the output rather than only the summary line at the bottom. A complete chain shows your certificate followed by the intermediate; if only one certificate comes back, the combined file in Step 3 did not include the intermediate.

For a broader scan of your certificate and its trust chain, use our SSL Checker. Note that it reaches your server over HTTPS, so it checks the certificate on the web interface rather than the one bound to FTPS. When the two services share a certificate, that is the same file; when they do not, test FTPS with the command above.

Frequently Asked Questions