| Subject: | Problem with client certificate SSL connections |
There seems to be a problem with the data connection when using SSH_Advanced hash to
create connections using client certificates.
Sanitized debug output:
..
SKT >>> AUTH SSL
SKT <<< 234 AUTH SSL OK.
..
Show quoted text
>>> USER anonymous
<<< 331 Password required for anonymous.
Show quoted text>>> PASS *******
<<< 230 User ..user.. logged in.
Show quoted text>>> CWD /users/username/incoming/
<<< 250 CWD command successful.
Show quoted text>>> CWD //users/username/ougoing/
<<< 250 CWD command successful.
Show quoted text>>> PBSZ 0
<<< 200 PBSZ Command successful. (PBSZ=0)
Show quoted text>>> PROT P
<<< 200 PROT set to P.
Show quoted text>>> PASV
<<< 227 Entering Passive Mode (...)
Show quoted text>>> LIST
<<< 150 ASCII mode SSL data connection for /bin/ls (...).
<<< 550 Client certificate rejected by ChainVerifier.
Can't list outbound dir (SSL wants a read first) at test-net-ftpssl.pl line 29.
The client SSL certificate appears to work once I got the hash correct and once the connection
is established the server recognizes the client user correctly. Changing directories works but
getting a list of files fails.
Here's the relevant code:
#!/usr/bin/perl
use strict;
use warnings;
use Data::Dumper;
use Net::FTPSSL;
my $ftps = new Net::FTPSSL(
'ssl.ftp.server.com',
Port => 21,
Encryption => 'E',
Debug => 1,
SSL_Advanced => {
'SSL_version' => 'SSLv3',
'SSL_use_cert' => 1,
'SSL_server' => 0,
'SSL_key_file' => 'private.pem',
'SSL_cert_file' => 'pubkey.pem',
'SSL_passwd_cb' => sub { return 'password_for_key' },
},
) or die "Unable to connect to remote host";
$ftps->login('anonymous', 'test@domain.com') or die "Can't login";
$ftps->cwd('/users/username/incoming/') or die "Can't change to inbound dir";
$ftps->cwd('/users/username/outbound/') or die "Can't change to outbound dir";
my @x = $ftps->list() or die "Can't list outbound dir (" . $ftps->errstr() . ")";
print Dumper(\@x);
$ftps->quit() or die "Error closing connection; " . $ftps->errstr() . "\n";
In an email exchange you mentioned you suspected the open connection method for data
channel is not using the SSL_Advanced hash.