0

We are in the process of making our site PCI compliant. One of the vulnerabilities we are facing is as below.

Description: SSL Version 2 (v2) Protocol Detection (for ftp)
Synopsis: The remote service encrypts traffic using a protocol with known weaknesses.
Resolution: Purchase or generate a proper certificate for this service.

Another one is as below (the program is again FTP)

Description: SSL Certificate Cannot Be Trusted
Synopsis: The SSL certificate for this service cannot be trusted.
Resolution: Purchase or generate a proper certificate for this service.

After studying things I think we need to purchase a SSL certificate for FTP. Now I have some questions

1) When I try to purchase an SSL certificate for FTP there is no option for SSL 
 certificate specific for FTP.  So which should we buy? I know this might 
 depend on my security company (like Thwate, Verisign etc..) but if possible 
 then can someone give an example?

2) Our site does have HTTP SSL and it is installed perfectly and working 
 perfectly so will the same certificate (HTTP SSL Certificate) 
 work for FTP too??

3) Which should we configure here, FTPS or SFTP?
Improve this question

1 Answer 1

Reset to default
3

1) You can buy a Webserver certificate, it will work.

2) If the CN (blog.domain.com) is the same, it will work.

3) FTPS and SFTP are not the same :

  • FTPS is FTP over SSL/TLS.
  • SFTP is FTP over SSH.

In your case, it is FTP(S).

Improve this answer
3
  • thx for the answer and +1 for helping me .. i am using servu ftp server .. i just need to install my HTTP SSL there and my FTPS will start working right ??
    – Dhaval
    Dec 4, 2013 at 16:02
  • Yes, but if your CN is different you will have an error at the client side.
    – Vinz
    Dec 4, 2013 at 16:22
  • no .. both are same .. and thx for all ur help .. i will accept your answer after sometime
    – Dhaval
    Dec 4, 2013 at 16:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .