Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Situation: a client with an AIX machine can't connect properly to a Windows 2003 Server running FTP server Serv-U FTP Server v10.2. Plain FTP works. SFTP is not working.

It's not clear where the error is, whether this is an issue on the FTP client or server side. They are connecting with an ftp binary that has a -s flag option.

Here's what they see on their side:

$ ftp -s -D 900 ftp.example.com
Connected to XX.XXX.XX.XXX.
220 Serv-U FTP Server v10.2 ready...
234 AUTH command OK. Initializing SSL connection.
TLS Auth Entered.

ERROR  Error during the hand shake for the control connection
ERROR  Error setting BIO object for the control connection
FTP: Unable to authenticate to Server.

Using a FreeBSD machine, I was trying to see if I could evaluate what might be happening, so what I tried was running curl as below, and also using curl inside PHP, and I get a sense that it's possible there's an issue with SSL certificates on the Windows server. But then other folks have been able to connect from other machines using SFTP without issue, so it's hard to say where the problem is.

Here's a curl command and the output error I get from a FreeBSD machine outside the network:

curl --ftp-ssl ftp://ftp.example.com

The result is:

curl: (60) SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). The default
 bundle is named curl-ca-bundle.crt; you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

What can I do to see where the fault might be? Any guidance on how to debug this and maybe see the certs that are being passed back and forth? Or maybe guidance on what to tell the client to do to give us something more diagnostic than "unable to authenticate." Again, when we open vanilla FTP to them, everything works fine, so it's definitely in the security of the connection.

share|improve this question
add comment

1 Answer

As far as I know, none of the AIX versions up to 7.1 ship with a SSL capable FTP client (and there's no -s switch as you show in your example), so it sounds like they're using a non-standard client, which could be anything really.

Maybe ask them to switch to LFTP, or Curl from IBM's RPM packages, both have FTP over SSL support

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.