SSL certificate support for FTPS :: Support Forum

faruxx
Joined:: 2014-12-18
Posts:: 8
Location:: Turkey

SSL certificate support for FTPS

2015-03-06 10:40

Hi,

Will you add SSL cert support? I can't add our certs for connection.

I can add other FTP client, but I dont want use it. WinSCP is best for me 8)

abcx.JPG (53.22 KB)

Reply with quote

martin◆ Site Admin
Joined:: 2002-12-10
Posts:: 41,454
Location:: Prague, Czechia

Re: SSL certificate support for FTPS

2015-03-09

It's a priority for the next release.
Issue 921 – Authentication with TLS/SSL client certificates

Reply with quote

faruxx

Thanks

2015-03-09 12:57

Thanks very much.

Reply with quote

martin◆ Site Admin

Re: Thanks

2015-03-13

I have sent you an email with a development version for testing.

Reply with quote

faruxx

Late Answer

2015-03-13 19:10

Sorry for late answer,

İ sent details with mail.

Reply with quote

hniland
Joined:: 2015-04-14
Posts:: 2
Location:: Arnhem, The Netherlands

Re: Thanks

2015-04-14 09:26

Hi,
I'm busy with the same issue.
Need a Client with Certificate Authentication (and User/Password) on a FTPS connection.
Could I get a version with these options available please?

Thanks
Henk Niland

Reply with quote

martin◆ Site Admin

Re: Thanks

2015-04-16

@hniland: Sent. I appreciate any feedback.

Reply with quote

hniland
Joined:: 2015-04-14
Posts:: 2
Location:: Arnhem, The Netherlands

Re: Thanks

2015-04-16 08:36

Hi, thanks
although I haven't received it yet.
If you've sent the program itself rather then a link, it is probably halted by our security scanner on the mail.
It will take some time to get it released, so I can use it.
As soon as I've got it, I will let you know if it works alright.
Greetings,
Henk.

Reply with quote

martin◆ Site Admin

Re: Thanks

2015-04-16

It's just a link. I've resent it. Maybe you get this time.

Reply with quote

yayitza
Joined:: 2015-04-20
Posts:: 1

Cert authentication

2015-04-20 07:40

Hi,

Can I get a this too? I need to connect to an FTP that requires certificate authentication.

thanks!

Reply with quote

martin◆ Site Admin

Re: Cert authentication

2015-04-20

@yayitza: Sent.

Reply with quote

clemensh
Joined:: 2015-05-12
Posts:: 6

Re: Cert authentication

2015-05-12 14:25

Hi,

can you send it to me, too? Would be great!
By the way, when is release date für 5.8?

Thank you very much!
ch

Reply with quote

martin◆ Site Admin

Re: Cert authentication

2015-05-13

@clemensh: Sent.
We do not give any dates. But it won't be soon.

Reply with quote

johnasd@hotmail.com
Joined:: 2015-05-26
Posts:: 1

SSL certificate support for FTPS

2015-05-26 10:47

Hi
I am very interested in testing the FTPS certificate functionality.
Would it be possible to receive a link to the development version?

Thanks!
John

Reply with quote

TheDoctor
Joined:: 2015-05-27
Posts:: 1

Request for Version with FTPS Client Certificate Support

2015-05-27 14:41

May I please get the development version with client certificate support for FTPS as well?

Thanks a lot!

Reply with quote

martin◆ Site Admin

Re: SSL certificate support for FTPS

2015-05-29

Sent to both of you.

Reply with quote

johnasd Guest

SSL certificate support for FTPS

2015-05-30 08:48

Thank you!
One question, what would the command switch to specify the certificate file and passphrase?

Reply with quote

martin◆ Site Admin

Re: SSL certificate support for FTPS

2015-06-02

See https://winscp.net/eng/docs/scriptcommand_open
It's -clientcert and -passphrase.
I'm sending you the latest build that will match a future production version.

Reply with quote

JMisset
Joined:: 2015-06-10
Posts:: 3

2015-06-10 18:25

Hi,

Could you also give me a link to the development version? I would also very much like to try this feature.

Thanks in advance!
Jasper

Reply with quote

martin◆ Site Admin

2015-06-12

@JMisset: Sent.

Reply with quote

JAllison
Joined:: 2015-06-15
Posts:: 1
Location:: Troy, MI

2015-06-15 18:54

A vendor of ours is requiring certificate authentication. Would it be possible to send me a link to the development version to test out? Thanks so much if you can!

Reply with quote

martin◆ Site Admin

2015-06-16

@JAllison: Sent.

Reply with quote

clemensh

Re: SSL certificate support for FTPS

2015-06-22 10:33

Can you please send me this version, too? I will need the correct console commands in future. Thanks!

Reply with quote

JMisset

2015-06-23 19:29

Thanks! Enjoying it so far :)! Nice work.

Just one question.. Every time I set up a connection it asks me for the client certificate password. Is there a way to make WinSCP remember it?

Reply with quote

martin◆ Site Admin

Re: SSL certificate support for FTPS

2015-06-23

@clemensh: Sent.

Reply with quote

martin◆ Site Admin

2015-06-23

@JMisset: Did you consider saving the certificate without passphrase?

Reply with quote

JMisset

2015-06-24 19:15

@martin: Do you mean removing the passphrase from the certificate? I'm afraid that this is not an option for me.

Reply with quote

martin◆ Site Admin

2015-07-03

@JMisset: Why? The point of the passphrase is to have the key protected. Yet, you are willing to have WinSCP remember the password, effectively breaking this. What's the difference?

Reply with quote

Marty
Joined:: 2015-07-12
Posts:: 4

test certificate authentication

2015-07-12 15:42

I'd also like to test certificate authentication. Could you send me a portable 5.8 dev build as well, please? (or point me to a location where I can download it myself)?

Reply with quote

martin◆ Site Admin

Re: test certificate authentication

2015-07-19

Sent.

Reply with quote

rlstreet
Joined:: 2015-07-26
Posts:: 1
Location:: The Netherlands

Re: test certificate authentication

2015-07-26 09:52

@Marty: Could you also give me a link to the development version?

Reply with quote

ebstc
Joined:: 2015-07-26
Posts:: 1
Location:: USA

Link

2015-07-26 15:22

My I have a copy too?

Reply with quote

martin◆ Site Admin

Re: test certificate authentication

2015-07-27

@ebstc: Sent.

Reply with quote

jdantzler
Joined:: 2012-12-07
Posts:: 13

2015-08-04 19:48

I'd like to test it out too if possible? Thanks.

Reply with quote

martin◆ Site Admin

2015-08-07

@jdantzler: Sent.

Reply with quote

Marty
Joined:: 2015-07-12
Posts:: 4

What kind of certificate and private key format is WinSCP execting?

2015-08-07 18:10

What kind of certificate and private key format is WinSCP (version 20150710r) expecting?

When I try it with OpenSSH generated keys, I get the following:

winscp> open sftp://marty@10.0.0.2 -clientcert=G:\Keystore\client_key-cert.pub -privatekey=G:\Keystore\client_key
Searching for host...
Connecting to host...
Authenticating...
Unable to use key file "G:\Keystore\client_key" (OpenSSH SSH-2 private key)
Using username "marty".
Disconnected: No supported authentication methods available (server sent: publickey)
Authentication log (see session log for details):
Unable to use key file "G:\Keystore\client_key" (OpenSSH SSH-2 private key)
Using username "marty".

Authentication failed.

Reply with quote

martin◆ Site Admin
Joined:: 2002-12-10
Posts:: 41,454
Location:: Prague, Czechia

Re: What kind of certificate and private key format is WinSCP execting?

2015-08-11

@Marty: The client certificates are for TLS/SSL (FTPS, WebDAVS), not for SSH/SFTP.

For SSH/SFTP, you use private keys, which WinSCP always supported (-privatekey).

You just have to convert the key to .ppk format.

Use PuTTYgen:
https://winscp.net/eng/docs/ui_puttygen

Reply with quote

Marty
Joined:: 2015-07-12
Posts:: 4

Re: What kind of certificate and private key format is WinSCP execting?

2015-08-13 15:54

martin wrote:

The client certificates are for TLS/SSL (FTPS, WebDAVS), not for SSH/SFTP.

I'm trying to make an SFTP connection with a server signed client certificate.
I've already tested it, and it works on Linux with:

sftp -i <client_key> marty@10.0.0.2

The Linux sftp client expects the following naming convention in order for the client to pick up the certificate and its complementary private key:
<client_key> (private key)
<client_key>.pub (public key)
<client_key>-cert.pub (CA signed public key)

How does it work with WinSCP (version 20150710r)?
I expect it will be needing access to the certificate and its private key.
How do I have to supply those?
(BTW The SFTP server only allows authentication with client certificates.)

Reply with quote

martin◆ Site Admin
Joined:: 2002-12-10
Posts:: 41,454
Location:: Prague, Czechia

Re: What kind of certificate and private key format is WinSCP execting?

2015-08-14

@Marty: That's a proprietary extension of OpenSSH server.
https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/PROTOCOL.certkeys?annotate=HEAD
WinSCP does not support this.
There are no client certificates in proper SSH.

Edit 2024: It's supported now:
Issue 1873 – Support for OpenSSH certificates for user authentication

Reply with quote

Marty
Joined:: 2015-07-12
Posts:: 4

Re: What kind of certificate and private key format is WinSCP execting?

2015-08-16 07:40

@martin: What a pity. It works like a charm.

I read the following:
Difference between SSH and SSL | Difference Between | Difference between SSH vs SSL

SSL means “Secure Sockets Layer”. Many protocols — like HTTP, SMTP, FTP, and SSH ‘“ were adjusted to include the support of SSL. Basically, it works as a tier in a certain protocol to provide cryptographic and security functions.

The combination of certificates and SSH is very powerful. There is no need any more for users to copy their public keys to the server. The Certificate issuer (CA / signer) can make the certificate valid for a limited time period. SSH options can be allowed or disallowed per certificate. It's great.

Reply with quote

BCH
Joined:: 2015-08-19
Posts:: 1
Location:: France

2015-08-19 15:19

Hello,
I also am working on a particular use case with a need for client certs on implicit FTPS connections.

If possible, I'd like to test the 5.8 version for our particular case: cert and its key are located either on a smart-card, or a USB dongle.

Thanks a lot!

Reply with quote

martin◆ Site Admin

2015-08-22

@BCH: WinSCP supports file certificates only.
Anyway, I have sent you an email with a development version of WinSCP to address you have used to register on this forum.

Reply with quote