04-02-2012
Query: How to install commercial cert into AIX and use it for FTPS connection
Hi Techies,
I wish to check with everyone here something regarding Configuration of FTPS Server in AIX using Commercial Digital Cert instead of Sel Sign Cert.
I'm working as system integration designer and I'm currently working on a interface which involves integration btw two systems using an integration middleware. Basically I need I need to establish a FTPS (SSL) connection from the middleware to a FTP Server Deamon Running in a IBM AIX box.
The system owner of the AIX has already configured the FTP Server using Self Sign Cert and the middleware is able to establish FTPS connection.
However to satisfy the internal security requirement, we were requested to a CA signed Cert, such as verisign or trustis instead of self sign cert for the FTPS connection.
Hence we have generated a CSR from the AIX machine and generated a CA cert and used the cert in the place of the self signed cert. However the FTPS connection is not working using this CA cert. Even a local FTP -s localhost connection is not working.
Can anyone suggest the right way to get this working. Do we need to import and configure the CA root cert and the public key?
I'm struggling with this for almost a month now, hope some of you can guide me in this. Thanks
Regards
Muraly
9 More Discussions You Might Find Interesting
1. AIX
I'm currently investigating the secure ftp connection from AIX using shell script - It looks openssl is already install and don't know command to be used to connect the secure ftp server.
1. Do I need to install certificate on AIX ?.
2. If any one already design the script to connect secure... (0 Replies)
Discussion started by: dharanir
0 Replies
2. AIX
Hi,
a friend of mine passed there 223 last year and they gave me there testkiller document which was 65 questions, i am looking at doing my 223 exam and i have gone to testkiller recently and noticed there is an updated version which is now 383 questions.
I did the ibm pre-exam and all the... (1 Reply)
Discussion started by: rorted
1 Replies
3. UNIX for Dummies Questions & Answers
I wrote a very simple script to calculate the DB connection from an appserver and check the total netstat connection to a particular DB exceed 25 then it will send mail
netstat -a 2> /dev/null | awk '/.*ESTAB/{print $5}' | cut -d. -f1 | uniq -c | awk '{if ($1 > 25)print $2," exceed ",$1;}'
... (1 Reply)
Discussion started by: senthil.ak
1 Replies
4. AIX
I have created a .bff package for an app to tbe installed on AIX servers across regions. I am pretty new to the AIX mode of packaging using mkinstallp but I have been able to get the same done. I installed the same on the server in which i created the package and the application was deployed... (9 Replies)
Discussion started by: jobbyjoseph
9 Replies
5. Shell Programming and Scripting
Hi
I'm trying to create a connection with DB from shell script using the following string
sqlplus <user>@<db_instance>/<password>
in which I'm successful.
However, after connecting to DB it is giving me a sql prompt as follows
=====================
Connected to:
Oracle Database 10g... (2 Replies)
Discussion started by: sainisumit1
2 Replies
6. Emergency UNIX and Linux Support
Hi,
I'm trying to get a self-signed cert created on AIX 6.1, and it's not cooperating. I run the following command: gsk7cmd -cert -create -db /bin/A_CACertsOnly.kdb -pw blahblah -label testing -dn cn=machinename -expire 1000 -ca true...and get this response:
The function is not supported for... (3 Replies)
Discussion started by: tekster2
3 Replies
7. UNIX for Dummies Questions & Answers
Hi,
I'm trying to access to FTP SERVER over SSL with this script unix :
(credentials are correct)
#!/usr/bin/ksh
USER="test"
PASSWORD="pwdtest"
IP="**.***.*.***"
ftp -s $IP 990 << EOF >>log_ftp
user $USER $PASSWORD
bin
passive
EOF
but seems that credentials are not passed... (2 Replies)
Discussion started by: nash83
2 Replies
8. Shell Programming and Scripting
I have a requirement for which I had to connect to a server using FTPS. I have been provided with these,
connection method: FTPS
Server Name
Port for explicit and implicit
Login user
I would like to know the FTPS command/script in order to connect to there server and get a file.
... (5 Replies)
Discussion started by: r@v!7*7@
5 Replies
9. UNIX for Advanced & Expert Users
Hi,
I am working on an application which runs on an Informatica Red-Hat 5.10 Linux Server.
The application involves several Informatica ETL workflows which generate 100s of Text files with lot of data. Many of the files will each be up to 5 GB in size.
Currently the Informatica server itself... (7 Replies)
Discussion started by: waavman
7 Replies
LEARN ABOUT CENTOS
ne_ssl_set_verify
NE_SSL_SET_VERIFY(3) neon API reference NE_SSL_SET_VERIFY(3)
NAME
ne_ssl_set_verify - register an SSL certificate verification callback
SYNOPSIS
#include <ne_session.h>
typedef int ne_ssl_verify_fn(void *userdata, int failures, const ne_ssl_certificate *cert);
void ne_ssl_set_verify(ne_session *session, ne_ssl_verify_fn verify_fn, void *userdata);
DESCRIPTION
To enable manual SSL certificate verification, a callback can be registered using ne_ssl_set_verify. If such a callback is not registered,
when a connection is established to an SSL server which does not present a certificate signed by a trusted CA (see ne_ssl_trust_cert), or
if the certificate presented is invalid in some way, the connection will fail.
When the callback is invoked, the failures parameter gives a bitmask indicating in what way the automatic certificate verification failed.
The value is equal to the bit-wise OR of one or more of the following constants (and is guaranteed to be non-zero):
NE_SSL_NOTYETVALID
The certificate is not yet valid.
NE_SSL_EXPIRED
The certificate has expired.
NE_SSL_IDMISMATCH
The hostname used for the session does not match the hostname to which the certificate was issued.
NE_SSL_UNTRUSTED
The Certificate Authority which signed the certificate is not trusted.
Note that if either of the NE_SSL_IDMISMATCH or NE_SSL_UNTRUSTED failures is given, the connection may have been intercepted by a third
party, and must not be presumed to be "secure".
The cert parameter passed to the callback represents the certificate which was presented by the server. If the server presented a chain of
certificates, the chain can be accessed using ne_ssl_cert_signedby. The cert object given is not valid after the callback returns.
RETURN VALUE
The verification callback must return zero to indicate that the certificate should be trusted; and non-zero otherwise (in which case, the
connection will fail).
EXAMPLES
The following code implements an example verification callback, using the dump_cert function from ne_ssl_cert_subject to display
certification information. Notice that the hostname of the server used for the session is passed as the userdata parameter to the callback.
static int
my_verify(void *userdata, int failures, const ne_ssl_certificate *cert)
{
const char *hostname = userdata;
dump_cert(cert);
puts("Certificate verification failed - the connection may have been "
"intercepted by a third party!");
if (failures & NE_SSL_IDMISMATCH) {
const char *id = ne_ssl_cert_identity(cert);
if (id)
printf("Server certificate was issued to '%s' not '%s'.
",
id, hostname);
else
printf("The certificate was not issued for '%s'
", hostname);
}
if (failures & NE_SSL_UNTRUSTED)
puts("The certificate is not signed by a trusted Certificate Authority.");
/* ... check for validity failures ... */
if (prompt_user())
return 1; /* fail verification */
else
return 0; /* trust the certificate anyway */
}
int
main(...)
{
ne_session *sess = ne_session_create("https", "some.host.name", 443);
ne_ssl_set_verify(sess, my_verify, "some.host.name");
...
}
SEE ALSO
ne_ssl_trust_cert, ne_ssl_readable_dname, ne_ssl_cert_subject
AUTHOR
Joe Orton <neon@lists.manyfish.co.uk>
Author.
COPYRIGHT
neon 0.30.0 31 July 2013 NE_SSL_SET_VERIFY(3)