this is causing headache for a long time now.

Situation: i have a virtual machine that sits behind a proxy that shields it off the internet. The Proxy seems to work fine.

I want to use cURL to transfer (-T) a ZIP file to a FTP on the internet. The FTP Server requires FTPS i.e. SSL/TLS to be used.

From my Windows machine i can use the same Proxy (and same proxy credentials) within TotalCommander to succesfully establish a FTPS session to the FTP Server i want to use.

So i think FTP server as well as Proxy Server are configured OKAY for the purpose.

What i try:

Basically i try variations of the follow commandline:

curl -vvv --ssl -T /path/to/my/file.zip ftp://my.ftpserver.com:21 --user USER:PASSWORD -x https://proxyuser:[email protected]:3128

I see in the verbose output, that cURL can authenticate against the proxy and tries to connect to the FTP Server. However, it keeps getting an error from SQUID (the proxy) that

Squid sent the following FTP command:
USER myftp user

The server responded with:
You must issue the AUTH command to change to an encrypted session before you can attempt to login.
550-This server requires encryption

When i change the destination to use ftps:// instead of ftp:// it keeps telling me

curl: (35) gnutls_handshake() failed: An unexpected TLS packet was received.

When i look into the log of the Totalcommander FTP session, i see that it authenticates against the Proxy. Then connects to the FTP Server and then changes to secure mode for Authentication.

220-Welcome to Company-FTP
220 Company-FTP Server ready!
234 Changing to secure mode...
(cert stuff)
USER myftpuser
331 Username OK. Need password.
PASS **********
230 Password oK. Connected. logged in

What could i possibly do wrong here?

I researched this a bit and found a post in the curl mailing list that "--tlsv1" option should send "AUTH TLS" first before "AUTH SSL", however i do not think it is done, because even if i use the --tlsv1 switch, Squid will comeback with the same error message saying that it send "USER myftpuser" and got that 550 error back.

Is there a way to force cURL to send this "AUTH TLS" that Totalcommander seems to send and then auths succesfully?

Thanks a lot aslmx

1 Answer 1


I believe the answer is to use the --ftp-ssl option.
I think this is similar to how openssl requires the -starttls ftp option. These are required because TLS for FTP is somewhat different from TLS for HTTP and other protocols.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .