Situation: a client with an AIX machine can't connect properly to a Windows 2003 Server running FTP server Serv-U FTP Server v10.2. Plain FTP works. SFTP is not working.
It's not clear where the error is, whether this is an issue on the FTP client or server side. They are connecting with an ftp binary that has a
-s flag option.
Here's what they see on their side:
$ ftp -s -D 900 ftp.example.com Connected to XX.XXX.XX.XXX. 220 Serv-U FTP Server v10.2 ready... 234 AUTH command OK. Initializing SSL connection. TLS Auth Entered. ERROR Error during the hand shake for the control connection ERROR Error setting BIO object for the control connection FTP: Unable to authenticate to Server.
Using a FreeBSD machine, I was trying to see if I could evaluate what might be happening, so what I tried was running curl as below, and also using curl inside PHP, and I get a sense that it's possible there's an issue with SSL certificates on the Windows server. But then other folks have been able to connect from other machines using SFTP without issue, so it's hard to say where the problem is.
curl command and the output error I get from a FreeBSD machine outside the network:
curl --ftp-ssl ftp://ftp.example.com
The result is:
curl: (60) SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed More details here: http://curl.haxx.se/docs/sslcerts.html curl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). The default bundle is named curl-ca-bundle.crt; you can specify an alternate file using the --cacert option. If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL). If you'd like to turn off curl's verification of the certificate, use the -k (or --insecure) option.
What can I do to see where the fault might be? Any guidance on how to debug this and maybe see the certs that are being passed back and forth? Or maybe guidance on what to tell the client to do to give us something more diagnostic than "unable to authenticate." Again, when we open vanilla FTP to them, everything works fine, so it's definitely in the security of the connection.