As of ProFTPD 1.3.3rc1, mod_tls only accepts SSL/TLS data connections that reuse the SSL session of the control connection, as a security measure. Unfortunately, there are some clients (e.g. curl) which do not reuse SSL sessions.
To relax the requirement that the SSL session from the control connection be reused for data connections, use the following in the proftpd.conf: