Re: Make certificate verification great again

--===============4571330862313593863==
Content-Type: multipart/alternative; boundary=94eb2c04f1464a976e054a838eed

--94eb2c04f1464a976e054a838eed
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Your understanding of CA is correct. The Comodo certificate should be
present in the CA bundle for the verification to succeed.

=D0=B2=D1=81, 12 =D0=BC=D0=B0=D1=80=D1=82=D0=B0 2017, 5:16 Nathana=C3=ABl N=
aeri <[email protected]>:

> I'm trying to connect to a FTP server that supports explicit FTPS
> using TLS, but I can't get certificate verification working. Most of
> the online help I find advises disabling certificate verification with
> "ssl:verify-certificate no", and I assume this is not good advice.
>
> My current understanding of the process is that lftp downloads the
> server's certificate when it negotiates TLS, then follows the
> certificate chain up to the certificate of a root CA, and trusts that
> root CA because it is in my list of trusted third parties, that I
> indicate to lftp using "ssl:ca-file
> /etc/ssl/certs/ca-certificates.crt" (the root CA certificates bundle
> file). This is, as far as I know, what web browsers do when they
> connect to HTTPS hosts (isn't it?).
>
> This doesn't appear to work so I guess I don't understand right. The
> debug output is:
>
> $ lftp -d -p 21 -u USER,PASS SERVER.seedbox.fr
> lftp [email protected]:~> set ssl:ca-file
> /etc/ssl/certs/ca-certificates.crt
> lftp [email protected]:~> ls
> ---- Connecting to SERVER.seedbox.fr (IPADDRESS) port 21
> <--- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------
> <--- [other 220 info]
> ---> FEAT
> <--- [feat reply]
> ---> AUTH TLS
> <--- 234 AUTH TLS OK.
> ---> OPTS UTF8 ON
> Certificate:
> C=3DFR,postalCode=3D77310,ST=3DSeine-et-Marne,L=3DPRINGY,street=3DIMPASSE
> DU BREAU,O=3DSDBX FRANCE,OU=3D0002 529997199,CN=3D*.seedbox.fr
>  Issued by: C=3DGB,ST=3DGreater Manchester,L=3DSalford,O=3DCOMODO CA
> Limited,CN=3DCOMODO RSA Organization Validation Secure Server CA
> ERROR: Certificate verification: Not trusted
> **** Certificate verification: Not trusted
> ---- Closing control socket
> ls: Fatal error: Certificate verification: Not trusted
>
> However, if I download the server's certificate beforehand, using a
> web browser or the OpenSSL CLI (openssl s_client -connect
> SERVER.seedbox.fr:21 -starttls ftp), and then points lftp to this
> certificate using "ssl ca-file
> /path/to/manually/downloaded/server/certificate.crt", the certificate
> verification succeeds. Why? What is verified in this case, precisely?
> That the certificate lftp downloads from the server during TLS
> negotiation is the same as one that was previously downloaded? How
> does that authenticates the server?
>
> And does this mean that the user has to maintain a certificate
> database of the servers they connect to? I thought the point of
> certificate hierarchies was that the user would only have to maintain
> a short list of trusted third party certificates (the root CA
> certificates).
>
> Thanks in advance for your help
> Na=C3=ABl
> _______________________________________________
> lftp mailing list
> [email protected]
> http://univ.uniyar.ac.ru/mailman/listinfo/lftp
>

--94eb2c04f1464a976e054a838eed
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<p dir=3D"ltr">Your understanding of CA is correct. The Comodo certificate =
should be present in the CA bundle for the verification to succeed. </p>
<br><div class=3D"gmail_quote"><div dir=3D"ltr">=D0=B2=D1=81, 12 =D0=BC=D0=
=B0=D1=80=D1=82=D0=B0 2017, 5:16 Nathana=C3=ABl Naeri &lt;<a href=3D"mailto=
:[email protected]">[email protected]</a>&gt;:<br></div><bl=
ockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #=
ccc solid;padding-left:1ex">I&#39;m trying to connect to a FTP server that =
supports explicit FTPS<br class=3D"gmail_msg">
using TLS, but I can&#39;t get certificate verification working. Most of<br=
 class=3D"gmail_msg">
the online help I find advises disabling certificate verification with<br c=
lass=3D"gmail_msg">
&quot;ssl:verify-certificate no&quot;, and I assume this is not good advice=
.<br class=3D"gmail_msg">
<br class=3D"gmail_msg">
My current understanding of the process is that lftp downloads the<br class=
=3D"gmail_msg">
server&#39;s certificate when it negotiates TLS, then follows the<br class=
=3D"gmail_msg">
certificate chain up to the certificate of a root CA, and trusts that<br cl=
ass=3D"gmail_msg">
root CA because it is in my list of trusted third parties, that I<br class=
=3D"gmail_msg">
indicate to lftp using &quot;ssl:ca-file<br class=3D"gmail_msg">
/etc/ssl/certs/ca-certificates.crt&quot; (the root CA certificates bundle<b=
r class=3D"gmail_msg">
file). This is, as far as I know, what web browsers do when they<br class=
=3D"gmail_msg">
connect to HTTPS hosts (isn&#39;t it?).<br class=3D"gmail_msg">
<br class=3D"gmail_msg">
This doesn&#39;t appear to work so I guess I don&#39;t understand right. Th=
e<br class=3D"gmail_msg">
debug output is:<br class=3D"gmail_msg">
<br class=3D"gmail_msg">
$ lftp -d -p 21 -u USER,PASS <a href=3D"http://SERVER.seedbox.fr" rel=3D"no=
referrer" class=3D"gmail_msg" target=3D"_blank">SERVER.seedbox.fr</a><br cl=
ass=3D"gmail_msg">
lftp [email protected]:~&gt; set ssl:ca-file<br class=3D"gmail_msg">
/etc/ssl/certs/ca-certificates.crt<br class=3D"gmail_msg">
lftp [email protected]:~&gt; ls<br class=3D"gmail_msg">
---- Connecting to <a href=3D"http://SERVER.seedbox.fr" rel=3D"noreferrer" =
class=3D"gmail_msg" target=3D"_blank">SERVER.seedbox.fr</a> (IPADDRESS) por=
t 21<br class=3D"gmail_msg">
&lt;--- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------<br cl=
ass=3D"gmail_msg">
&lt;--- [other 220 info]<br class=3D"gmail_msg">
---&gt; FEAT<br class=3D"gmail_msg">
&lt;--- [feat reply]<br class=3D"gmail_msg">
---&gt; AUTH TLS<br class=3D"gmail_msg">
&lt;--- 234 AUTH TLS OK.<br class=3D"gmail_msg">
---&gt; OPTS UTF8 ON<br class=3D"gmail_msg">
Certificate: C=3DFR,postalCode=3D77310,ST=3DSeine-et-Marne,L=3DPRINGY,stree=
t=3DIMPASSE<br class=3D"gmail_msg">
DU BREAU,O=3DSDBX FRANCE,OU=3D0002 529997199,CN=3D*.<a href=3D"http://seedb=
ox.fr" rel=3D"noreferrer" class=3D"gmail_msg" target=3D"_blank">seedbox.fr<=
/a><br class=3D"gmail_msg">
=C2=A0Issued by: C=3DGB,ST=3DGreater Manchester,L=3DSalford,O=3DCOMODO CA<b=
r class=3D"gmail_msg">
Limited,CN=3DCOMODO RSA Organization Validation Secure Server CA<br class=
=3D"gmail_msg">
ERROR: Certificate verification: Not trusted<br class=3D"gmail_msg">
**** Certificate verification: Not trusted<br class=3D"gmail_msg">
---- Closing control socket<br class=3D"gmail_msg">
ls: Fatal error: Certificate verification: Not trusted<br class=3D"gmail_ms=
g">
<br class=3D"gmail_msg">
However, if I download the server&#39;s certificate beforehand, using a<br =
class=3D"gmail_msg">
web browser or the OpenSSL CLI (openssl s_client -connect<br class=3D"gmail=
_msg">
<a href=3D"http://SERVER.seedbox.fr:21" rel=3D"noreferrer" class=3D"gmail_m=
sg" target=3D"_blank">SERVER.seedbox.fr:21</a> -starttls ftp), and then poi=
nts lftp to this<br class=3D"gmail_msg">
certificate using &quot;ssl ca-file<br class=3D"gmail_msg">
/path/to/manually/downloaded/server/certificate.crt&quot;, the certificate<=
br class=3D"gmail_msg">
verification succeeds. Why? What is verified in this case, precisely?<br cl=
ass=3D"gmail_msg">
That the certificate lftp downloads from the server during TLS<br class=3D"=
gmail_msg">
negotiation is the same as one that was previously downloaded? How<br class=
=3D"gmail_msg">
does that authenticates the server?<br class=3D"gmail_msg">
<br class=3D"gmail_msg">
And does this mean that the user has to maintain a certificate<br class=3D"=
gmail_msg">
database of the servers they connect to? I thought the point of<br class=3D=
"gmail_msg">
certificate hierarchies was that the user would only have to maintain<br cl=
ass=3D"gmail_msg">
a short list of trusted third party certificates (the root CA<br class=3D"g=
mail_msg">
certificates).<br class=3D"gmail_msg">
<br class=3D"gmail_msg">
Thanks in advance for your help<br class=3D"gmail_msg">
Na=C3=ABl<br class=3D"gmail_msg">
_______________________________________________<br class=3D"gmail_msg">
lftp mailing list<br class=3D"gmail_msg">
<a href=3D"mailto:[email protected]" class=3D"gmail_msg" target=3D"_blank">=
[email protected]</a><br class=3D"gmail_msg">
<a href=3D"http://univ.uniyar.ac.ru/mailman/listinfo/lftp" rel=3D"noreferre=
r" class=3D"gmail_msg" target=3D"_blank">http://univ.uniyar.ac.ru/mailman/l=
istinfo/lftp</a><br class=3D"gmail_msg">
</blockquote></div>

--94eb2c04f1464a976e054a838eed--

--===============4571330862313593863==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
lftp mailing list
[email protected]
http://univ.uniyar.ac.ru/mailman/listinfo/lftp

--===============4571330862313593863==--