Client certificates or just a server certificate? I think CAfile also works for the server CA although the documentation does not make that explicit.
If upping the debug levels on the client does not help, also consider doing a packet capture of the session. Analysis of this will show any TLS conversation.
A full example in documented in the article
HP-UX - FTPS: How to Setup FTPS on a FTP Client, part of which follows.
The full reference for ftp cited from that is WU-FTPD 2.6.1 release notes, HP-UX 11i v1, HP-UX 11i v2, HP-UX 11i v3. Good luck deciphering the server CA from it, it seems mixed up in the examples providing client certs.
Connect using the command line:
# ftp -z CAfile=/etc/ftp/security/cacert.pem <server>
# ftp -z CAfile=/etc/ftp/security/cacert.pem \
-z cert=/home/user1/client-cert.pem \
-z key=/home/user1/client-key.pem <server>
Connect using a Configuration File:
# vi /home/user1/.tls.conf
# ftp -z config=/home/user1/.tls.conf <server>
Connect using Environment Variables:
The following is the minimum required variables for a basic FTPS connection.
Be sure to add the additional appropriate variables if the client certificate for authentication is needed. See the WU_FTPD Release Notes for details.
It is important to use the to source in a file of environment variables to keep them in the existing shell.
# vi /home/user1/.ftps_envar.sh
\#The following are the minimum options for ftps:
export FTP_SSL_CA_FILE=/etc/ftp/security/cacert.pem #CACert
# cd /home/user1/
# . /home/user1/.ftps_envar.sh
# ftp <server>
# ftp -z CAfile=/etc/ftp/security/cacert.pem MyFTPServerHostName.hp.com
Connected to MyFTPServerHostName.hp.com.
220 MyFTPServerHostName.hp.com FTP server (Revision 1.1 Version wuftpd-2.6.1(PHNE_38578) Fri Sep 5 12:10:54 GMT 2008) ready.
234 AUTH TLS OK. ? TLS/SSL Authentication passed
[TLSv1/SSLv3, cipher DHE-RSA-AES256-SHA, 256 bits]
331 Password required for root.
230 User root logged in.
Remote system type is UNIX.
Using binary mode to transfer files.
TLS/SSL protection of control connection: on.
TLS/SSL protection of data connections: off.
Verify the OS, WU-FTPD and SSL versions.
Review the ftpd and ftp CLI options.
Review the configuration files and/or environment variables contents.
Review the certificate file paths and file permissions.
Review the server syslog file.
Review the certificates files themselves:
# openssl x509 -text -noout -in /etc/ftpd/security/cacert.pem |more
# ftpd -v -l -z debug=2 -z logalldata
# ftp -z debug=2 -z secure -z logfile=/tmp/ssl.log -z