🚀 SSL/TLS required on the data channel error during FTP connection: how to fix

You connect to a server via FTP through your code editor, enter the host, login, and password, and get a red line in response: SSL/TLS required on the data channel. Sound familiar? This error occurs when the server requires an encrypted connection, but the client tries to connect over plain FTP. This happens especially often on hosting providers with self-signed certificates.

Previously, this problem was solved in Atom through the Remote FTP plugin. Atom died in December 2022, but the error hasn't gone anywhere. It lives on in VS Code, FileZilla, Pulsar, and any FTP client that connects to a server with a self-signed SSL certificate.

In this post, three working ways to bypass SSL/TLS required on the data channel: for Atom/Pulsar through .ftpconfig, for VS Code through the SFTP extension, and for GUI clients like FileZilla. Plus an important warning: when rejectUnauthorized: false is an acceptable workaround, and when it's a security hole.

💡 Quick overview:

• Where the error comes from: the server requires TLS, the client sends plain FTP, the connection drops at the data channel stage.
• .ftpconfig with rejectUnauthorized: false and secure: true is the solution for Atom and its fork Pulsar that works with the Remote FTP plugin.
• In VS Code, the SFTP extension by liximomo with the secure: true parameter solves the same problem at the sftp.json config level.
• In FileZilla and other GUI clients, simply switch the protocol from FTP to FTPS (Explicit TLS) and accept the certificate manually.
• Security: rejectUnauthorized: false disables certificate verification and is acceptable only for dev servers and test environments, never in production.

Where the SSL/TLS required on the data channel error comes from

The FTP protocol works through two channels: control channel (commands) and data channel (actual file transfer). When the server is configured for FTPS (FTP over TLS), it encrypts both. A client that tries to connect via regular FTP successfully passes authentication on the control channel, but when attempting to open the data channel, the server responds: 550 SSL/TLS required on the data channel.

The technical reason lies in the TLS implementation on the Node.js side (which both Remote FTP for Atom and the VS Code SFTP extension are built on). Node.js validates SSL certificates by default. A self-signed certificate fails this validation, and the connection drops. The solution: either explicitly tell the client not to verify the certificate (rejectUnauthorized: false), or switch to explicit FTPS with manual certificate acceptance.

Solution 1: proper.ftpconfig for Atom and Pulsar

Atom was officially discontinued in December 2022, but its fork Pulsar (formerly Atom) is fully compatible with Atom packages, including Remote FTP. The solution is to specify the correct secureOptions in .ftpconfig.

Create (or edit) the .ftpconfig file in the project root:

1
{
2
    "protocol": "ftp",
3
    "host": "your.server.com",
4
    "port": 21,
5
    "user": "login",
6
    "pass": "password",
7
    "promptForPass": false,
8
    "remote": "/",
9
    "secure": true,
10
    "secureOptions": {
11
        "rejectUnauthorized": false
12
    },
13
    "connTimeout": 10000,
14
    "keepalive": 10000
15
}

Key parameters:

• secure: true enables TLS for both control and data channels;
• rejectUnauthorized: false disables certificate verification (Node.js stops requiring a valid certificate from the server);
• port: 21 is the standard port for FTP; for FTPS via implicit TLS, use port 990 and protocol: "ftps".

After saving .ftpconfig, reconnect to the server, and the SSL/TLS required on the data channel error will disappear.

Solution 2: configuring the SFTP extension in VS Code

The most popular extension for FTP/SFTP in VS Code is SFTP by liximomo (1.3+ million installs). The 550 SSL/TLS required on the control channel error is discussed in issue #872.

After installing the extension, run Ctrl+Shift+P → SFTP: Config, and the sftp.json file will open. Configure it as follows:

1
{
2
    "name": "My server",
3
    "host": "your.server.com",
4
    "protocol": "ftp",
5
    "port": 21,
6
    "secure": true,
7
    "username": "login",
8
    "password": "password",
9
    "remotePath": "/",
10
    "uploadOnSave": true
11
}

The secure: true parameter is a direct equivalent of rejectUnauthorized: false from .ftpconfig. It tells the extension to use FTPS and not drop the connection when encountering a self-signed certificate.

If the server uses implicit FTPS (port 990), change protocol to ftps and port to 990. Save sftp.json, run SFTP: Download Project, and the extension will connect and download the contents of remotePath.

Solution 3: FileZilla and other GUI clients

In GUI clients, the problem is solved even more simply at the interface level. In FileZilla:

• Open Site Manager (Ctrl+S).
• Select the connection, and in the Protocol field switch from FTP to FTP over TLS (explicit).
• On the first connection, FileZilla will show a dialog with the certificate fingerprint; click Trust this certificate and check "Always trust."

The same principle works in WinSCP, Cyberduck, and any modern FTP client: explicitly specify the FTPS protocol and accept the certificate manually. No configs, just the interface.

When you should NOT disable certificate verification

rejectUnauthorized: false is a deliberate weakening of security. You're telling the client: "accept ANY certificate, even a forged one." This is acceptable in three cases:

• A local dev server or staging environment not accessible from the internet.
• Your own VPS, where you know exactly where the certificate came from.
• A test environment behind a corporate VPN.

On a production server with a self-signed certificate, it's better to spend 15 minutes setting up Let's Encrypt, a free SSL certificate that all clients recognize without rejectUnauthorized: false.

Watch this short tutorial on SFTP connection in VS Code, covering all steps from installing the extension to the first server connection:

⁉️🤔 Frequently asked questions

The error remains after secure: true; what else should I check?

First, verify the port. Explicit FTPS works on port 21, implicit on 990. If the server admin requires implicit FTPS but you specified protocol: "ftp" with port: 21, the connection won't establish no matter how much you change secureOptions. Check your hosting panel or ask the admin which FTPS mode the server uses.

Can I use SFTP instead of FTPS?

Yes, and this is the preferred option. SFTP (SSH File Transfer Protocol) works over SSH, not FTP, so SSL certificate issues simply don't exist for it. If the server provides SSH access, use SFTP instead of FTPS. In the same .ftpconfig, just change protocol to sftp and port to 22.

Atom has been discontinued; does Remote FTP still work?

The Remote FTP package is available in the Atom repository, but the editor itself hasn't been updated since December 2022 and contains known vulnerabilities. GitHub even revoked the code signing certificates for Atom in January 2023. If Atom still launches on your machine, migrate to the Pulsar fork, which pulls the same packages and configs without changes.

What about VS Code Remote SSH?

Remote SSH is an excellent alternative to FTP connections if the server runs Linux and has SSH access. You work with files directly, without synchronization and certificate hassles. But for shared hosting where SSH is closed and access is only via FTP, the solutions in this post remain relevant.

The error SSL/TLS required on the control channel (not data channel): is this the same thing?

Yes, the only difference is which channel the connection dropped on. Control channel handles commands (authentication, navigation), data channel handles file transfer. The server can require TLS on either of them. The solution is identical: secure: true + rejectUnauthorized: false in the config.

Error persists: final checklist

Go through the items; one of them will resolve the issue:

• Protocol: is secure: true set in the config (.ftpconfig or sftp.json)?
• Port: explicit FTPS = 21, implicit = 990, SFTP = 22. Verify against server settings.
• rejectUnauthorized: a self-signed certificate will NOT pass Node.js validation without this option.
• GUI client: did you switch Site Manager to FTP over TLS (explicit) and manually accept the certificate?
• SFTP instead of FTPS: if you have SSH access, forget about FTP and switch to SFTP.

If you've tried everything and the error persists, the server is most likely configured for implicit FTPS (port 990), while the client is connecting to port 21. Check with your hosting provider for the required mode and port.

This error is not an editor bug but a feature of the TLS handshake with a self-signed certificate. After proper config setup, it disappears on any client: whether in Atom from 2018, Pulsar from 2026, or VS Code.