UNIX for Dummies Questions & Answers

Hi Techies,

I wish to check with everyone here something regarding Configuration of FTPS Server in AIX using Commercial Digital Cert instead of Sel Sign Cert.

I'm working as system integration designer and I'm currently working on a interface which involves integration btw two systems using an integration middleware. Basically I need I need to establish a FTPS (SSL) connection from the middleware to a FTP Server Deamon Running in a IBM AIX box.

The system owner of the AIX has already configured the FTP Server using Self Sign Cert and the middleware is able to establish FTPS connection.

However to satisfy the internal security requirement, we were requested to a CA signed Cert, such as verisign or trustis instead of self sign cert for the FTPS connection.

Hence we have generated a CSR from the AIX machine and generated a CA cert and used the cert in the place of the self signed cert. However the FTPS connection is not working using this CA cert. Even a local FTP -s localhost connection is not working.

Can anyone suggest the right way to get this working. Do we need to import and configure the CA root cert and the public key?

I'm struggling with this for almost a month now, hope some of you can guide me in this. Thanks

Regards
Muraly

IBM Setting up FTPS / TLS with ftp on AIX 6.1 - United States

note the last step

Code:

10. Finally, we adjust the path names in /etc/ftpd.cnf file: (assumes .tls is created in "/" directory)

CERTIFICATE /.tls/server.pem
CERTIFICATE_PRIVATE_KEY /.tls/server.pem

Hi Frank,

Thanks for the hint, infact I have visited this site before when I was searching for the solution to my problem. We have followed the all the steps mentioned in that thread. The only difference was, instead of generating a Self Sign Cert using the CSR (created at step 7) we pass the CSR to a CA to generate the Digital Cert. Meaning we skip the step 8 and continue from Step 9, after getting the CA signed cert (meaning to say, we issued the following cmd "cat server_key.pem server_cert.pem rootCA/root_cert.pem > server.pem" using the CA Cert "server_cert.pem")

May I know if the steps we have followed is correct? Pls advice

Thanks

Hi guys, just to update, I'm still not able get this working, any other things I could try? Pls advice

does the AIX server have access to the VeriSign (or other certificate provider) site? This is a requirement to verify the certificate chain.

Domenic

Hi Domenic,

No I dong think so the AIX has access to Internet, but I can double confirm this shortly. But is it really a requirement that it must have access to Internet for this?

In order to validate the certificate chain, it must get to the signers site. The server does not require full internet access, but it MUST be able to access the signer IP and Port. Contact the certificate provider to verify the address and port that is used and setup your firewall for all servers using the certificate.

Domenic