Generate CSR and installing SSL certificate for Serv-U

10/11/2018 6:49 PM

6/30/2025 2:26 PM

Serv-U supports self-signed certificates created directly, or third-party certificates from certificate authorities. For more information on certificate authorities, visit this Wikipedia page. 

Using the SSL certificate, Serv-U supports FTPS and HTTPS. The supported format is base64 or binary (i.e. .crt .cer or .pem).

Serv-U also supports using an SSL certificate with multiple subject alternative names (SANs) for different Serv-U domains as long as the domain DNS information is included in the SAN listing.

Note: Domains that share listeners can only use a single certificate for each encryption method. Make sure also that the certificate path has the right permission to be accessed by Serv-U. See Running Serv-U under NETWORK SERVICE

 

Serv-U Managed File Transfer & Serv-U FTP Server

Generate and Submit Certificate Signing Request

1. On the Serv-U Configuration page, navigate to Domains. 
2. Expand the desired domain and select Limits & Settings. 
3. On the Limits & Settings page, select the Encryption tab.

2. Click Create Certificate. A pop-up page New Certificate Creation will appear.

3. On the New Certificate Creation page, complete the fields as explained below under the Output and Certificate Information sections:

• • Output
    • Certificate Set Name:  Enter the desired file name of the certificate
    • Output Directory:  Enter the location where the new certificate, .key and .CSR will be saved
  • Certificate Information
    • Enter the appropriate address details for your new certificate in the relevant fields
    • Password: Set the password for the certificate

3. Click Create. A new pop-up message confirming the creation of certificate will appear.

4. Click Yes. You will be redirected to the Limits & Settings page.
5. On your server, navigate to the output folder on your server where the Certificate Signing Request (CSR) is stored.

Note: This is the path specified in the Output directory field in Step 3.

6. Submit the CSR file to your Certificate Authority (CA) provider by uploading the file through their portal or via email depending on the CA’s process.
7. Once the CSR is submitted, the CA will verify the information and then send you the certificate reply. The reply will come as a file (usually with a .crt or .pem extension) containing the signed SSL/TLS certificate. 

 

Install Certificate Reply in Serv U

1. On the Limits & Settings page, navigate to the Encryption tab. Complete the fields as explained below:
   1. Certificate Path: This field specifies the location of the certificate file issued to the customer by the Certificate Authority (CA). Click the browse button against Certificate Path field to set the file location of the certificate issued to the customer by the CA. 
   2. Private Key Path: The private key is generated at the time the CSR is generated and is stored in a file on your server. If you generated the CSR, the private key is saved in the directory where the CSR was created. Click the browse button against the Private Key Path field to set the location of the Private key file. The Private key file is often a .key file. 

Note: If the private key file is missing or unavailable, then it is likely that you did not generate a CSR.

1. 3. CA (Certificate Authority) Path: Click the browse button against CA (Certificate Authority) Path field to set the path to the intermediate certificates issued by the CA. Not installing the CA can cause problems when certification validation occurs. When you submit a request to the Certificate Authority (CA), they will provide intermediate certificates that should be installed along with the server’s certificate. You can find the CA Path in the documentation or email instructions provided by your CA, where they will usually provide you with links or attachments containing the intermediate certificates.

2. Click Save.

You have successfully installed the new certificate. There is no need to restart the Serv-U service. Verify your certificate was successfully installed by accessing your Serv-U page.

Note: If the SSL certificate is used in the Global level Encryption, make sure you have the same information in the Domain level Encryption. If you have the SSL certificate information in the Domain level, you can leave the Global level Encryption blank. The CA (Certificate Authority) Certificate Path field accepts a .cer or .crt file extension. The SSL certificate information can also be controlled in the Load Balancer instead of the Serv-U Management Console, specially if there are multiple instances of Serv-U in deployment. Serv-U can only use one certificate at a time (for one domain configurations). If both the Global and Domain level have SSL certificates, then the Domain level will be used. If only the Global level has a certificate and nothing on the Domain level, then the Global cert will be used (and vise versa for if the certificate is only in the domain level).