it’s quite tricky to set ssl/tls ftp – for the same reasons ftp is tricky for natting and firewalling: control channel, data channels on various ports, encryption of just control channel, but not data channels etc., etc… – but I believe you are aware of this. I’d agree with Edhacker, that most convenient way would be to set up ssh server instead of ftp server and use scp and sftp – there are some cool gui-clients for windows (winscp, sftp plugin for the Total Commander, etc.)

If, however, your users insist on using their favorite ftp-clients, offer them ssh-tunneling option. You have again to set up ssh server on the ftp server host, and instruct users how to build and use ssh tunnels. Most ssh clients don’t support ftp-tunneling – again because of “data channels” scheme, but some have “helpers” – just like in linux connection tracking. In fact, the only such client I have used is appgate’s MindTerm. It is still alive, and if it’s licensing is OK for you, your users are happy.

Some years ago I had prepared presentation on this and some close topics, you can still can find it on:

http://cose.math.bas.bg/CSE/M4/PAlovConnectivity.pdf

pp. 19-20 deal with MindTerm setup for ftp tunneling.

But anyway, ftp is outdated – better use scp/sftp.

Good luck,

Petko