You are viewing a plain text version of this content. The canonical link for it is here.
Posted to ftpserver-users@mina.apache.org by Jeff Poling <cr...@yahoo.com> on 2009/01/22 03:50:10 UTC
Using FTPS
Hi folks, I hope you can help me.
I'm trying to set up FtpServer to use SSL. I set the attributes in the ftpd.xml file to use the keystore and trustore, generated the certificate request and used it to get a certificate from a company CA, imported the certificate into the keystore and the CA's root cert into the keystore and truststore.
When I try to access the site using FileZilla set to use FTPS, it doesn't work. When I look in the ftpd.log file, there's a java stacktrace with an SSL exception of "no cipher suites in common." I've googled and read the FtpServer message archives, and been unable to find a solution.
Help?
Re: Using FTPS
Posted by Jeff Poling <cr...@yahoo.com>.
--- On Thu, 1/22/09, David Latorre <dv...@gmail.com> wrote:
> We had the same issue in my company; it seems they
> imported the certificate
> from the CA in an empty keystore, so they had to import the
> private key ...
> Can it be your issue? Are you able to use the very same
> keystore for HTTPS
> access with e.g., tomcat?
Yep. We have an application that uses 2-way SSL between Tomcat 6 and ASP.NET 2, and they have no problem talking to each other. I used the same keystore and batch files to generate the FtpServer SSL stuff as I did the Tomcat SSL stuff.
Re: Using FTPS
Posted by David Latorre <dv...@gmail.com>.
Hello Jeff,
We had the same issue in my company; it seems they imported the certificate
from the CA in an empty keystore, so they had to import the private key ...
Can it be your issue? Are you able to use the very same keystore for HTTPS
access with e.g., tomcat?
2009/1/22 Jeff Poling <cr...@yahoo.com>
> Hi folks, I hope you can help me.
>
> I'm trying to set up FtpServer to use SSL. I set the attributes in the
> ftpd.xml file to use the keystore and trustore, generated the certificate
> request and used it to get a certificate from a company CA, imported the
> certificate into the keystore and the CA's root cert into the keystore and
> truststore.
>
> When I try to access the site using FileZilla set to use FTPS, it doesn't
> work. When I look in the ftpd.log file, there's a java stacktrace with an
> SSL exception of "no cipher suites in common." I've googled and read the
> FtpServer message archives, and been unable to find a solution.
>
> Help?
>
>
>
>
>
Re: Using FTPS
Posted by Niklas Gustavsson <ni...@protocol7.com>.
On Thu, Jan 22, 2009 at 3:50 AM, Jeff Poling <cr...@yahoo.com> wrote:
> I'm trying to set up FtpServer to use SSL. I set the attributes in the ftpd.xml file to use the keystore and trustore, generated the certificate request and used it to get a certificate from a company CA, imported the certificate into the keystore and the CA's root cert into the keystore and truststore.
>
> When I try to access the site using FileZilla set to use FTPS, it doesn't work. When I look in the ftpd.log file, there's a java stacktrace with an SSL exception of "no cipher suites in common." I've googled and read the FtpServer message archives, and been unable to find a solution.
That error comes from the SSL handshake where the client and server
tries to negotiate on what cipher suite (basically encryption and
hashing algorithms) and finding that they have none in common.
Anyways, it's a very weird error to get as the JVM usually contains a
huge list of allowed suites, and FileZilla should support many of
them. However, I think the certificates also can limit what suite are
allowed, could you maybe check that? I'm assuming you have not
provided a list of allowed cipher suites in your FtpServer
configuration?
/niklas
Re: Using FTPS
Posted by Niklas Gustavsson <ni...@protocol7.com>.
On Sat, Jan 24, 2009 at 3:38 AM, Jeff Poling <cr...@yahoo.com> wrote:
> I have no idea. I went back to the original batch files with the intention of adding one change at a time until it worked ... and it worked with the original batch files. No idea what I did wrong ... repeatedly ... to cause it not to work the first several days I used these files. Thanks to everybody for your help.
I'm glad to hear you got it working, whatever way it was :-)
/niklas
Re: Using FTPS
Posted by Jeff Poling <cr...@yahoo.com>.
--- On Thu, 1/22/09, Jeff Poling <cr...@yahoo.com> wrote:
> Got it working.
>
> I did a lot of different things all at once, so I don't
> know what made it work. Once I figure it out, I'll
> report back.
I have no idea. I went back to the original batch files with the intention of adding one change at a time until it worked ... and it worked with the original batch files. No idea what I did wrong ... repeatedly ... to cause it not to work the first several days I used these files. Thanks to everybody for your help.
Re: Using FTPS
Posted by Jeff Poling <cr...@yahoo.com>.
Got it working.
I did a lot of different things all at once, so I don't know what made it work. Once I figure it out, I'll report back.
Re: Using FTPS
Posted by Jeff Poling <cr...@yahoo.com>.
--- On Thu, 1/22/09, gary.bell@aero.bombardier.com <ga...@aero.bombardier.com> wrote:
> I have my ftp server set to use SSL server-side only and I
> can connect to
> it no problem with filezilla. My certificate was a trial
> one from thawte
> and they have specific instructions for java jks keystores.
> Have a look at
> :
>
> Although that last one is for tomcat, it seemed to work for
> me.
>
> - Does it work OK if you create a self-signed cert using
> keytool?
I looked through those websites and tried a couple of things I saw there, and it still didn't work. I started over and used only a self-signed certificate, and that didn't work either. I'm at wits end.
Re: Using FTPS
Posted by Jeff Poling <cr...@yahoo.com>.
> From: gary.bell@aero.bombardier.com <ga...@aero.bombardier.com>
Saw a couple things to try. Will report back.
One of the most common comments I've seen has been the RSA one. I did check and the command line I'm using and it does use the -keyalg rsa switch, and when I double click on the cert I get back from the CA, it says its a sha1RSA certificate.
> - Does it work OK if you create a self-signed cert using
> keytool?
Didn't try that, will put that on the list of things to try.
Re: Using FTPS
Posted by ga...@aero.bombardier.com.
I have my ftp server set to use SSL server-side only and I can connect to
it no problem with filezilla. My certificate was a trial one from thawte
and they have specific instructions for java jks keystores. Have a look at
:
https://search.thawte.com/support/ssl-digital-certificates/index?page=content&id=S:SO5230&actp=search&searchid=1232617028046
https://www.thawte.com/ssl-digital-certificates/technical-support/keygen/tomcat_keygen.html
Although that last one is for tomcat, it seemed to work for me.
Some other good reference material I used:
http://www.sslshopper.com/article-most-common-java-keytool-keystore-commands.html
- Does it work OK if you create a self-signed cert using keytool?
Best Regards,
Gary Bell