topic Re: copy /ftp/ssl issue in Operating System - OpenVMS

copy /ftp/ssl issue

stephenbrayshaw — Tue, 08 Jan 2019 15:05:36 GMT

I am trying to use copy/ftp/ssl from one OpenVMS machine to another.

Both machines are running OpenVMS 8.4-2L1 & TCPIP 5.7-13ECO5F.

When I run it I get the following errors

TCPIP$_FTP_SSLERR, SSL not enabled on server
TCPIP$_FTP_SSLERR, Session will continue in plain text

How do I change the FTP server config to have the SSL enabled?

Re: copy /ftp/ssl issue

Steven Schweda — Wed, 09 Jan 2019 22:04:25 GMT

> How do I change the FTP server config to have the SSL enabled?

   I wish (slightly) that I knew. Around here (hobbyist):

ITS $ tcpip show version

HP TCP/IP Services for OpenVMS Industry Standard 64 Version V5.7 - ECO 5
on an HP rx2600 (1.50GHz/6.0MB) running OpenVMS V8.4

And my FTP log (sys$sysdevice:[tcpip$ftp]tcpip$ftp_run.log) always
begins with:

Certificate file not found
TCPIP$_FTP_NOSSL, FTP over SSL not supported

   There seems to be some relevant stuff in a "Release Notes" doc:

      https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-c04623347

      1.2.3.1 Configuring an FTP server for SSL

         To configure an FTP server and to allow the FTP server to
         handle incoming client connections which are over SSL, the
         certificates and keys must be copied at the following location:

         Certificate file : SSL$CERTS:SERVER.CRT
         Key file: SSL$KEYS:SERVER.KEY

        The key and certificate file of the server must be placed in
        this directory and must be named as SERVER.CRT and SERVER.KEY.
        During the FTP server startup, if it does not find either the
        key or the certificate file in the required location, the FTP
        server will not support SSL.

   There might be some guidance somewhere as to how to obtain/generate
these files, but you couldn't prove it by me.

Re: copy /ftp/ssl issue

stephenbrayshaw — Thu, 10 Jan 2019 11:29:05 GMT

Thank you very much Steven,

That was the fix, although I used the SSL1$ directories instead of the SSL$ ones.

I used @SSL1$COM:SSL1$CERT_TOOL to generate the self-signed cert.

Re: copy /ftp/ssl issue

Steven Schweda — Fri, 11 Jan 2019 06:31:56 GMT

> That was the fix, although I used the SSL1$ directories instead of the
> SSL$ ones.

Your stuff being newer than mine might matter. I used the SSL1 tool
to generate the files, but my FTP server seemed to look for them only in
the (plain-old) SSL directory.

Thanks for filling in the CERT_TOOL detail.