Re: SSL FTP question

[Scott Klement <midrange-l@xxxxxxxxxxxxxxxx>]

Paul,

With SSL, there's a certificate that states that a server really is the 
server it claims to be.  Then, there's a certificate authority (CA) 
certificate that tells you WHO determined that a system really is who it 
claimed to be.  In other words, who verified the facts?

Think of a CA certificate as like a notary public, verifying that a 
signature (or "certificate") is genuine.  Now imagine a world with rogue 
notarys... You have to determine who to trust, and who not to trust.  If 
you trust a certificate authority, you implicitly trust all certificates 
that it has signed.

In your example, your FTP client is connecting to a server.  One of the 
very first things that happens is that the FTP client receives the 
server's certificate.   (It's downloaded from the FTP server to the FTP 
client.)  In order for the client to know whether it trusts the server, 
it checks to see which signed it.  If the CA that signed it is installed 
in your digital certificate manager, and marked as "trusted" in the 
application profile for the FTP client, then the SSL connection will 
continue (and hopefully succeed).   However, if the CA certificate isn't 
installed, or isn't marked as "trusted", then you'll get the 
"certificate is not signed by a trusted certificate authority" error -- 
which is what you have.

Your message states "I'm pretty sure I told the DCM to sign the 
certificate as a trusted authority" -- which would only make sense if 
you're connecting to the same machine.  If you're connecting to a 
different computer (which seems likely) then the certificate would've 
been signed on THAT computer, or would've been signed by an external 
certificate authority.  In either case, you need to get the CA 
certificate for that certificate authority and install it into the DCM 
on the machine where you're running the FTP client.  And you may also 
need to mark it as "trusted" in the Application Definition (depending on 
whether the FTP client is currently set up as "trust all" or not.)

Does that make sense?




Paul Nelson wrote:
> Secure connection error, return code -23.
>
> -23   Certificate is not signed by a trusted certificate authority.
>
>
> Is this message issued by my machine or by the target machine when I
> try to connect with PORT(990) SECCNN(*IMPLICIT)  ?
>
> I'm pretty sure I told the DCM to sign the certificate as a trusted 
> authority.