A "GnuTLS error" or "Could not connect to server" message in FileZilla when using FTP over TLS (FTPS) means the encrypted connection could not be negotiated. The most common fix is to set the encryption to "Require explicit FTP over TLS" on port 21 and use passive mode. This guide covers the specific GnuTLS error numbers and what each one means.
Use "Require explicit FTP over TLS" on port 21
In FileZilla's Site Manager (File > Site Manager), set Protocol to "FTP - File Transfer Protocol", Encryption to "Require explicit FTP over TLS", and Port to 21. Explicit FTP over TLS (FTPES) is what Ultra Web Hosting servers support. Do not use implicit FTPS on port 990, and do not leave encryption set to "Only use plain FTP" if the server requires TLS.
01. The Correct FTPS Settings
Most GnuTLS and connection errors come from a mismatch between what your client offers and what the server expects. The working combination on our servers is:
- Protocol: FTP - File Transfer Protocol
- Encryption: Require explicit FTP over TLS
- Port: 21
- Host: your server hostname or direct IP (from your welcome email), not a Cloudflare-proxied domain
- Transfer mode: Passive
If your domain is proxied through Cloudflare (orange cloud), FTP will not work through it, because Cloudflare only proxies web traffic. Connect to your server's hostname or direct IP instead of the domain name. For more on explicit FTP over TLS, see Making a Connection with FTPES.
02. What the GnuTLS Error Numbers Mean
FileZilla uses the GnuTLS library for encryption, and its error numbers tell you where the handshake failed:
- GnuTLS error -15: An unexpected TLS packet was received - the client tried to start TLS but got a plain (unencrypted) reply, or the reverse. Usually means the encryption setting does not match the server, or a firewall or proxy is interfering with the connection. Set encryption to "Require explicit FTP over TLS" and try again.
- GnuTLS error -110: The TLS connection was non-properly terminated - the connection dropped mid-transfer. Often a passive-mode data channel being blocked by a firewall, or an idle timeout. Switch to passive mode and increase the timeout.
- GnuTLS error -12 / -53: A TLS fatal alert / error in the push function - the server or an intermediate device rejected or cut the TLS session. Try connecting from a different network to rule out your ISP or router.
Many GnuTLS errors are transient. If one appears once and the next reconnect works, it was a momentary network hiccup and nothing is wrong with your settings.
03. "Could Not Connect to Server"
When FileZilla shows "Could not connect to server" with a TLS setup, work through these in order:
- Confirm encryption is "Require explicit FTP over TLS" on port 21, not implicit FTPS on 990
- Connect by hostname or IP, not a Cloudflare-proxied domain
- Switch to passive mode (Site Manager > Transfer Settings > Passive)
- Increase the timeout to 60 seconds under Edit > Settings > Connection. See the FileZilla timeout fix
- Check for a firewall block on your IP with the Firewall Unblock tool
04. Passive Mode and the Data Channel
FTPS uses a control connection for commands and a separate data connection for transfers. In active mode the server connects back to you, which routers and firewalls usually block, and the result is a TLS error on the data channel even though login succeeded. Passive mode makes your client open both connections outbound, which works through almost all networks. This is the same fix as a 425 data connection error.
05. Certificate Warnings
The first time you connect with explicit FTP over TLS you will see a certificate warning. This is normal on shared hosting, where the certificate is issued for the server hostname rather than your individual domain. Check "Always trust this certificate in future sessions" and continue. It is not an error and does not mean the connection is insecure.
06. Still Failing? Check These
- Try a different network - a phone hotspot rules out your ISP or corporate firewall blocking FTPS
- Update FileZilla - very old versions ship outdated TLS libraries that modern servers reject
- Reduce concurrent connections to 2 or 3 (see Changing Concurrent Connections)
- Read the full log - the message log at the top of FileZilla shows the exact point the TLS handshake failed
Still Cannot Connect Over FTPS?
If explicit FTP over TLS in passive mode still fails, open a ticket and paste the full FileZilla message log (it does not contain your password). We will check the server side for you.
Open a Support TicketFrequently Asked Questions
What causes the FileZilla GnuTLS error?
A GnuTLS error in FileZilla is a TLS negotiation failure during an FTPS connection. It usually means FileZilla and the server could not agree on a working TLS version or cipher, the port or encryption setting is wrong, or a firewall is interfering with the secure data connection.
How do I fix Could not connect to server over FTPS in FileZilla?
Set the connection to use explicit FTP over TLS on port 21 in the FileZilla Site Manager, update FileZilla to the latest version so it supports current TLS, and make sure passive mode is enabled. On UWH hosting, explicit FTPS on port 21 with passive mode is the correct configuration.
Should I use explicit or implicit FTPS?
Use explicit FTP over TLS on port 21, which is the modern standard our servers expect. Implicit FTPS on port 990 is older and is not the configuration to use here. Selecting explicit TLS in the Site Manager resolves most GnuTLS handshake failures.
Why does FTPS work on one network but not another?
A network or router that blocks or rewrites the passive-mode data ports, or a local firewall that interferes with TLS, can make FTPS fail on one connection while it works on another. Enabling passive mode and testing from a different network helps confirm whether the block is local.
Quick Recap
- Use "Require explicit FTP over TLS" on port 21, never implicit FTPS on 990
- Connect by hostname or IP, not a Cloudflare-proxied domain
- Use passive mode so the encrypted data channel works behind firewalls
- GnuTLS -15 means an encryption mismatch; -110 means the data channel dropped
- Accept the certificate warning on first connect; it is normal on shared hosting
Resolving FTPS and TLS connection errors · Last updated November 2026 · Browse all FTP articles
