`ftps://`¶

TLS-wrapped FTP — implicit TLS on port 990 (encrypted from byte 0), or explicit AUTH TLS upgrade on port 21. Backed by github.com/jlaffaye/ftp with a TLS handshake configured by Helix. The ftp:// URI surface is fully inherited; the parameters documented below are the TLS-only additions.

For SSH-based remote file transfer, use sftp:// (distinct wire protocol).

URI shape¶

ftps://host:990/path?implicit=true&username=...&password=...&securityProtocol=TLSv1.3

host:port is the server. Default port is 990 (implicit TLS); set implicit=false and use port 21 for explicit AUTH TLS upgrade.

Parameters¶

ftps:// inherits every parameter from ftp:// (auth, connection, consumer extras, FTP-specific knobs, and the file://-inherited filter/sort/read-lock/scheduler/producer surface). The TLS-specific additions are:

Param	Type	Default	Description
`implicit`	boolean	`false`	Implicit TLS (port 990, encrypted from byte 0) vs explicit (`AUTH TLS` upgrade on port 21).
`securityProtocol`	enum	`TLSv1.3`	Minimum TLS version. `TLSv1.0` / `TLSv1.1` / `TLSv1.2` / `TLSv1.3`.
`tlsCAFile`	string	—	Path to PEM CA bundle for server certificate verification.
`tlsCertFile`	string	—	Path to client certificate (PEM) for mutual TLS.
`tlsKeyFile`	string	—	Path to client private key (PEM).
`tlsInsecureSkipVerify`	boolean	`false`	Skip server certificate verification (test-only).

See ftp:// for every other parameter — the descriptor list is generated by paramDescriptors("ftps") in pkg/component/ftp/describe.go.

Body shape¶

Identical to ftp://:

Consumer: file bytes in In body (or *exchange.StreamBody with streamDownload=true); CamelFile* headers populated.
Producer: In body bytes are written to a remote file named by fileName / CamelFileName.

Examples¶

Implicit TLS poll (port 990) with read-lock:

- from: ftps://secure.example.com:990/outbox?implicit=true&username=svc&password=secret&binary=true&readLock=changed&move=.done/${file:name}

Explicit AUTH TLS (port 21):

- from: ftps://secure.example.com:21/outbox?implicit=false&username=svc&password=secret

mTLS with a custom CA bundle:

- to: ftps://partner.example.com/uploads?implicit=true&tlsCAFile=/etc/ssl/partner-ca.pem&tlsCertFile=/etc/ssl/client.crt&tlsKeyFile=/etc/ssl/client.key&binary=true

Pin TLS to 1.2 for a legacy server:

- from: ftps://legacy.example.com:990/outbox?implicit=true&securityProtocol=TLSv1.2&username=u&password=p

Behavior notes¶

Implicit vs explicit. Implicit is the safer default (the handshake happens immediately); explicit relies on the server accepting AUTH TLS over plain TCP. Pick the one your server is configured for.
tlsInsecureSkipVerify. Disables certificate verification entirely. Acceptable for staging environments with self-signed certs; do not use it in production.
TLS handshake errors at startup. Same as ftp:// — controlled by throwExceptionOnConnectFailed. Default is WARN-and-retry per poll.
Inherited semantics. Same passiveMode=true default, same stepwise semantics, same idempotent auto-enable, same remote readLock defaults (readLockCheckInterval=5s, readLockTimeout=20s). readLock=fileLock is rejected.

Source¶

pkg/component/ftp/ftp.go — NewFTPS() registers the ftps scheme on the same Component type.
pkg/component/ftp/describe.go — TLS parameter descriptors live in schemeImplementedDescriptors("ftps").
pkg/component/ftp/tls_certpool.go — CA bundle loading.

ftps://¶