SSL problem!

whocarez2k5 · 07-17-2005, 11:13 AM

I have made own certificate with the instructions in the help file.

Now i try to test it local before put it online but for some reason it wont work, i have checked the settings and they seem right

### Encryption ####
Require_Encrypted_Auth = *
Require_Encrypted_Data = *
Certificate_Name = ioftpd.cer
Explicit_Encryption = True
Encryption_Protocol = SSL3
Min_Cipher_Strength = 128
Max_Cipher_Strength = 1024

Maybe i must say that i'm just new in to this but i have read the manual quite good i thought and it still wont work

Or is it impossible to test it local or must the cert placed in a specific dir?

This is the error i get:
[2] 220 FTP Server ready.
[2] AUTH SSL
[2] 504 AUTH %s unsupported.

PopWeasel · 07-17-2005, 11:29 AM

Quote:

Using TLS in ioFTPD.ini is best because then users can either use Auth SSL or AUTH TLS in their ftp client.

Code:

Encryption_Protocol     = TLS

Try that and see if it helps any.

whocarez2k5 · 07-17-2005, 11:42 AM

Nope still get this message

[2] 504 AUTH %s unsupported.

(I try it local btw

)

:update:
Well i'm still a n00b i guess, i missed 1 letter and now it works

Grendel · 07-18-2005, 02:22 AM

ok , try the following...

1)

stop ioFTPD

2)

start "certmgr.exe" and delete the old ioftpd cert.

3)

close "certmgr.exe"

4)

make a little batch in same path as makecert.exe

Code:

makecert.exe -r -n "CN=localhost" -b 01/01/2005 -e 01/01/2015 -eku 1.3.6.1.5.5.7.3.1 -ss my -sr CurrentUser -a sha1 -sk localhost -sky exchange -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12

5)

start the batch

6)

start "Certmgr.exe" , and check if the cert is here.

7)

edit ioFTPD.ini

Code:

Certificate_Name = localhost
Explicit_Encryption = True
Encryption_Protocol = SSL3
Min_Cipher_Strength = 128
Max_Cipher_Strength= 168

save .ini and start ioFTPD again

Good luck

P.S.:

Quote:

Max_Cipher_Strength = 1024

btw. ioFTPD 5.8.5 does not support more than 168Bit encryption by design,
because it's using internal Windows-structures for encryption - instead of Open-SSL

Grendel · 07-18-2005, 02:23 AM

Quote:

Originally Posted by whocarez2k5

:update:
Well i'm still a n00b i guess, i missed 1 letter and now it works

fine