Connecting to ftp - from a Windows Server 2012 - it works both secure (-over tls) and unsecure. From a Windows 7 it succeeds unsecure but fails when secure. (Using explicit TLS and passive mode.)


  • 234 AUTH command ok. Expecting TLS Negotiation.
  • Initializing TLS...
  • Connection timed out

I've tried many things but nothing helps. (I'm also trying this programmatically. For details see: https://stackoverflow.com/questions/25393716/ftp-ssl-fails-after-expecting-tls-negotiation )

The fact that it does succeed from one computer proves that the ftp server is fine. And the fact that the Windows 7 computer succeeds without tls proves that it's not a NAT/firewall problem (besides, it failed even after disabling firewall etc.). I'm not sure where to start looking. Perhaps a difference between PC Windows and Windows Server?


The ftp server is on a Windows Server 2012.


From the messages your provide it looks like the problem is in the SSL handshake, but for a better analysis more detailed would be necessary. What I've seen so far on problems in this area are:

  • Cipher problems. If the FTP server can only do ciphers which are deemed insecure by Windows 7 but are considered secure by Windows 2012 the handshake will fail. But usually you will see a simple fail and not a timeout.
  • TLS version problem. I've seen some servers which only can do SSL 3.0 and just close the connection if they get a TLS 1.0 or higher request. This usually does not cause a timeout too.
  • Bad load balancer. Older versions of F5 load balancers croaked on a Client Hello which was larger than 255 bytes. They've just dropped the packet which caused a timeout within the handshake at the client. This behaviour would match your problem.

If you need a better analysis please provide a packet dump (wireshark) and describe the network path between the client and the server, that is if there are any middleboxes in between which might cause problems.

  • Thanks. Some more info: The server is on Windows Server 2012. And I tried connecting directly to the modem and it made no difference. – ispiro Aug 20 '14 at 21:26
  • " I tried connecting directly to the modem" - I have no idea of your network architecture and where a modem resides. If you want a better analysis please provide the requested details. – Steffen Ullrich Aug 21 '14 at 4:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.