46

I'm trying to get my Pelican blog working. It uses lftp to transfer the actual blog to ones server, but I always get an error:

mirror: Fatal error: Certificate verification: subjectAltName does not match ‘blogname.com’

I think lftp is checking the SSL and the quick setup of Pelican just forgot to include that I don't have SSL on my FTP.


This is the code in Pelican's Makefile:

ftp_upload: $(OUTPUTDIR)/index.html
lftp ftp://$(FTP_USER)@$(FTP_HOST) -e "mirror -R $(OUTPUTDIR) $(FTP_TARGET_DIR) ; quit"

which renders in terminal as:

    lftp ftp://username@blogname.com -e "mirror -R /Volumes/HD/Users/me/Test/output /myblog_directory ; quit"

What I managed so far is, denying the SSL check by changing the Makefile to:

lftp ftp://$(FTP_USER)@$(FTP_HOST) -e "set ftp:ssl-allow no" "mirror -R $(OUTPUTDIR) $(FTP_TARGET_DIR) ; quit"

Due to my incorrect implementation I get logged in correctly (lftp username@myblog.com:~>) but the one line feature doesn't work anymore and I have to enter the mirror command by hand:

mirror -R /Volumes/HD/Users/me/Test/output/ /myblog_directory

This works without an error and timeout. The question is how to do this with a one liner.


In addition I tried:

  • set ssl:verify-certificate/ftp.myblog.com no
  • This trick to disable certificate verification in lftp:

    $ cat ~/.lftp/rc set ssl:verify-certificate no

However, it seems there is no "rc" folder in my lftp directory - so this prompt has no chance to work.

  • ~/.lftprc is a file – Mausy5043 Feb 27 '17 at 15:32
41

From the manpage:

-c commands
Execute the given commands and exit. Commands can be separated with a semicolon (;), AND (&&) or OR (||). Remember to quote the commands argument properly in the shell. This option must be used alone without other arguments.

So you want to specify the commands as a single argument, separated by semicolons:

lftp ftp://$(FTP_USER)@$(FTP_HOST) -e "set ftp:ssl-allow no; mirror -R $(OUTPUTDIR) $(FTP_TARGET_DIR) ; quit"

You can actually omit the quit command and use -c instead of -e.

  • That's great. Thanks a ton. I had hoped that someone who's more experienced than me would spot my failure instantly ( - I also tried your -c suggestion leaving out the quit, but this didn't work for me. I'm happy anyway). – patrick Jul 27 '12 at 21:14
32

I had a similar issue, though my lftp does have ssl support compiled in (Fedora RPM). ssl:verify-certificate false did the trick for me.

  • 10
    Based on this, putting set ssl:verify-certificate false in my ~/.lftprc solved the problem for me. – Nicolas Raoul Jul 23 '15 at 7:17
  • 5
    …though that defeats the point of using SSL your lftp now happily accepts whatever certificate it gets presented, making you vulnerable to M2M attacks. – spectras Feb 8 '17 at 16:00
  • 1
    If certificates are not validated properly, a likely cause is that lftp does not find the CA certificates of your system. See this answer for a fix. – ingomueller.net May 21 '17 at 10:26
18

echo "set ssl:verify-certificate no" >> ~/.lftp/rc

will solve the problem if you dont want the certificate to be checked

  • 2
    This still disables verification of SSL certificates and this makes man-in-the-middle attacks possible. For a better fix, see this answer. – ingomueller.net May 21 '17 at 10:27
  • 3
    better just execute set ssl:verify-certificate no in lftp shell to disable temporary for current session than disabling always. Still +1 for the solution. – akostadinov Jul 4 '17 at 10:12
8

ssl:verfy-certificate false didn't work for me, I was getting a timeout error when "making data connection".

I followed these instruction by adding set ftp:ssl-allow false to my ~/.lftprc file.

  • 3
    Did you spell it right when you ran the command? ssl:verify-certificate false – Malcolm Murdoch Oct 31 '14 at 10:34
5

In addition I tried:

  • set ssl:verify-certificate/ftp.myblog.com no
  • This trick to disable certificate verification in lftp:

$ cat ~/.lftp/rc set ssl:verify-certificate no

Try using set ftp:ssl-allow no; it worked like a charm for me.

  • 1
    This is the most appropriate choice. The global setting is a bad choice as it is reasonable to use certificate verification when possible and by setting the global option it will never try to verify the certificate. You can use a script file lftp -f <script> and place this command before the open command. – kmcguire May 10 '16 at 3:30
  • set ssl:verify-certificate no is better I think because the transaction remains secured. set ftp:ssl-allow no will communicate plaintext – michalzuber Aug 8 '17 at 11:39
4

I was also facing similar sort of ssl certificate verification error. Setting verify-certificate to 'no' worked for me.

Example:

lftp -c 'set ftps:initial-prot ""; set ftp:ssl-force true; set ftp:ssl-protect-data true; set ssl:verify-certificate no; open -u Usename,Password 208.82.204.46; put uploadfilename;'

3

I have read man pages and found solution. Create file

~/.lftp/rc

and add there next line:

set ssl:check-hostname false;
1

Need the lftp command: set ftp:ssl-allow no;

You could execute the command just after selecting:

lftp www.yourdomain.com -u username,password -e "set ftp:ssl-allow no;"

or save the command into ~/.lftprc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.