SslStream accept certificate?

Question

I made a simple ftp client in C # that does what I need (connect to ftp, optionally using a proxy), but I also want to use AUTH SSL.

So, instead of NetworkStream, I looked at SslStream and hoped that it would be a fairly simple replacement.

However, I seem to have a lot of problems when you contact my (glftpd, selfsigned openssl cert) ftp. Here's a snapshot of the code:

TcpClient client = new TcpClient("192.168.0.2", 1337); SslStream sslStream = new SslStream( client.GetStream(), false, new RemoteCertificateValidationCallback(ValidateServerCertificate), null ); try { sslStream.AuthenticateAsClient("192.168.0.2"); // or "glftpd", neither worked. } catch (AuthenticationException e) { Console.WriteLine("Exception: {0}", e.Message); if (e.InnerException != null) { Console.WriteLine("Inner exception: {0}", e.InnerException.Message); } Console.WriteLine("Authentication failed - closing the connection."); client.Close(); return; } 

I am breaking AuthenticateAsClient with an IOException: "Handshake failed due to unexpected packet format." I do not break ValidateServerCertificate (never reached).

It’s hard for me to debug this error, since I can set the TcpClient port to 1208219421 and still get the same error (so I don’t even know if it could talk to the ssl port).

The code (from 3-4 different C # ssl tutorials that I looked at) above is changed from the link text

I tried both sslStream.AuthenticateAsClient (..., ..., SslProtocols.Tls, false) and sslStream.AuthenticateAsClient (..., ... SslProtocols.Ssl3, false) Ssl2 and Default, and I know that TLS works with my glftpd installation.

If I had to guess, I would have thought that this had something to do with the name machinename / certname, but I tried the name certname (which is "glftpd"), so right now I don’t know why I failed the handshake.

It should also be noted that the certificate is self-signed.

Any help is much appreciated!

• Chuck

Answer 1

Have you checked the port number? This is problem?

EDIT 1

http://en.wikipedia.org/wki/FTPS

Perhaps your server is not in "Implicit" mode? Should it be?

You will probably also need Explicit Mode support in your product / instead.

EDIT 2

(Apologies, I can’t comment, not enough repetitions, so I'm making changes instead: .-))

If support for both explicit and implicit in your live code is not required, I often like to run TCP servers on two ports, if possible, one for implicit SSL and one for explicit / non SSL. Your server software may or may not support this.

EDIT 3

Depends on whether you manage the servers / how you want to meet the standards!

Implicit mode will be considered slightly less standardized, but OTOH is its lesser work.

EDIT 4

It might be better to defend against denial of service issues in order to use Explicit rather than Explicit, but I'm not sure I will need to examine the protocol. My experience is with XMPP.

EDIT 5

In addition, simply running the text in explicit mode can make some corporate legal departments a little more relaxed on the legal issues of any unauthorized access than with something that begins with the fact that it makes TLS gibberish directly on the body.