FTPS client - Server certificate could not be validated

Question

Hello friends,

Our partner - FTPS server owner - re-issues their Server certificate
They asked us to test our client connection using a test server they provided for this purpose.
Our tests fail with the error "Server certificate could not be validated".

How should I tackle this issue in order to make sure / prove that there it is something wrong with the new certificate.
Whether the new certificate if fine what else can be wrong .
Are any tools out there (Windows tools - free is possible) which I can use to test the server certificate ?

Below is the error stack trace :
com.enterprisedt.net.puretls.cert.CertificateVerifyException: Server certificate could not be validated.
at com.enterprisedt.net.puretls.n.B(Unknown Source)
at com.enterprisedt.net.puretls.Z.B(Unknown Source)
at com.enterprisedt.net.puretls.n.E(Unknown Source)
at com.enterprisedt.net.puretls.i.G(Unknown Source)
at com.enterprisedt.net.puretls.SSLSocket.handshake(Unknown Source)
at com.enterprisedt.net.ftp.ssl.SSLFTPControlSocket.E(Unknown Source)
at com.enterprisedt.net.ftp.ssl.SSLFTPClient.auth(Unknown Source)

Thank you in advance for any help,
George

Answer 1

Hi ,
I was digging further and tested the client side of FTPS connection using a free tool - WinSCP .

It is interesting that the utility gives me some certificate information.

There is Summary in that info which tells me :

"Self signed certificate in certificate chain. The error occurred at a depth of 4 in the certificate chain"

I am not sure what exactly it means but it looks like reports an error .
Can the that error having the same cause I get :
"com.enterprisedt.net.puretls.cert.CertificateVerifyException: Server certificate could not be validated." ??


Thank you and best regards,
George

Answer 2

One thing to try is to set SSLFTPStandardValidator.MAX_CERTIFICATE_CHAIN_LENGTH = 4

Answer 3

Thank you Bruce for your support.
I did that already but I think there might be another validation issue .
I guess that the server host name not be the CN (common name) .
How can I find out the CN - Common Name - from the server certificate .

Thank you for helping me ,
George

Answer 4

Hi Bruce ,
Beside SSLFTPStandardValidator.MAX_CERTIFICATE_CHAIN_LENGTH = 4 I also disabled the host name validation (via SSLFTPStandardValidator(false)).
The server certificate has been validated this time , thank you very mcuh for help.

I still have a question for you please.
The indicator that the certificate was issued to the server directly by a CA is that the length of the certificate chain is no more than 2.
Where can I find more details about this topic (length of certificate chain).
Could you please send me a link which details the above.

Thank you and best regards ,
George

Answer 5

Sure, there's some info here:

http://publib.boulder.ibm.com/infocente ... s7dca.html