TLS help

Question

I have read the ssl pages and I still can't get an ftps connection between the EDTFTPD server and my workstation. With TLS turned off, it works. I have been successful with SFTP on Linux, so perhaps I just don't understand how the certificates work. When I try to connect, it gives me the following error:

"SSL: Error in negotiating SSL connection. The server could be rejecting your certificate."

I tried recreating the certificate. I still get the same error. Do I have to create a cert from the server and install it on the client? I tried that as well, but it still failed.

Can someone post a walkthrough on how they got it to work?

Thanks,

Jonn

Answer 1

I suggest you start with TLS on and client certificates turned off. In edtFTPD set TLSRequired to 'on' and TLSVerifyClients to 'off'. Make sure you restart edtFTPD by pressing the 'Restart edtFTPD' button.

In SSLFTPClient turn off server validation by:

ftpClient.setValidateServer(false);

This is what example 1 (in examples\Ex1_NonvalidatingClient) does, so have a look at the listing.

Once you've got that working, you should enabled server validation. To do this, you'll need a copy of your server certificate (in edtFTPD\etc\server.cert.pem). You then need to enabled server validation and load this certificate into your SSLFTPClient by:

ftpClient.setValidateServer(false);
ftpClient.loadRootCertificates("server.cert.pem");

The complete code is in example 2 (in examples\Ex2_ServerValidatingClient).

Once that is working, you may like to use client validation as well. To do this you'll need to set TLSVeryClients to 'on' in edtFTPD and give edtFTPD access to a copy of your client certificate. You'll need to copy the contents of your base-64 encoded certificate file (e.g. PEM file) into your edtFTP\edt\ca-root.crt file. You then need to load the client certificate into your SSLFTPClient by:

ftp.loadClientKeyFile(clientKeyFile, clientKeyPassword);

The complete code is in example 3 (in examples\Ex3_FullyValidatingClient).

Hope that helps
- Hans (EDT Support)