Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using the Ubuntu 10.4 build in ProFTPD and don't understand why I have to "verify" the password I enter as it's checked immediately. (This reminds me on entering Wifi passwords twice in Windows where it's also nonsense.)

Prompt message:

ftpadmin@ftp:~$ sudo /etc/init.d/proftpd restart
  * Stopping ftp server proftpd                                           [ OK ] 
  * Starting ftp server proftpd                                                  
Please provide passphrases for these encrypted certificate keys:
RSA key for the x.x.x.x#21 ( server: 
Verifying - RSA key for the x.x.x.x#21 ( server: 
                                                                          [ OK ]

TLS config:

<IfModule mod_tls.c>
 TLSEngine                   on
 TLSLog                      /var/log/proftpd/tls.log
 TLSProtocol                 SSLv23
 TLSRSACertificateFile       /etc/ssl/private/server.crt
 TLSRSACertificateKeyFile    /etc/ssl/private/server.key
 TLSOptions                  AllowClientRenegotiations NoCertRequest EnableDiags 
 TLSVerifyClient             off
share|improve this question
SSL? Please give us the prompt message? – quanta Aug 16 '11 at 7:42
@quanta - I updated my question. – pitty.platsch Aug 16 '11 at 7:54
and the options related to TLS in your proftpd.conf? – quanta Aug 16 '11 at 8:13
@quanta - again I updated the question - Thanks for your help! – pitty.platsch Aug 16 '11 at 8:37
Are you sure you don't have a challenge password on both the crt and the key? I don't think it remembers the password and tries to apply it to the second file. – polynomial Aug 21 '11 at 8:12
TLSRSACertificateKeyFile    /etc/ssl/private/server.key

You get this dialog because the RSA private key inside your server.key is stored in encrypted format. You need a passphrase to parse this file.

You can remove the encryption from the RSA private key with:

cd /etc/ssl/private/
mv server.key server.key.bak
openssl rsa -in server.key.bak -out server.key
chmod 400 server.key

Now server.key will contain an uncrypted copy of the key, point TLSRSACertificateKeyFile to this file, it will not prompt you for a passphrase.

But, NOTICE that, if anyone gets this key, they will be able to impersonate you.

share|improve this answer
I'm aware that it's encrypted. My question is why I have to enter it TWICE? Once should be enough, not? – pitty.platsch Aug 16 '11 at 8:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.