Unable to Get Local Issuer Certificate
Hi,
We're using WinSCP version 5.15.9 (Build 10071) and are connecting to our server in the DMZ to upload files using WinSCP .NET. The connection is over FTPS, implicit encryption. The script was working fine when it was on Windows 2008 R2. We cut over to Windows 2016 and now the script errors with "Summary: Unable to get local issuer certificate. The error occurred at a depth of 2 in the certificate chain." This is occurring in both our test and production environments which are both Windows 2016. I can connect without issue from the GUI.
The logs are as follows:
As you can see the fingerprint has been added. In the GUI, I went to Session > Server/Protocol Information and confirmed that the fingerprint is the same.
Any ideas?
We're using WinSCP version 5.15.9 (Build 10071) and are connecting to our server in the DMZ to upload files using WinSCP .NET. The connection is over FTPS, implicit encryption. The script was working fine when it was on Windows 2008 R2. We cut over to Windows 2016 and now the script errors with "Summary: Unable to get local issuer certificate. The error occurred at a depth of 2 in the certificate chain." This is occurring in both our test and production environments which are both Windows 2016. I can connect without issue from the GUI.
The logs are as follows:
3:04.858 -------------------------------------------------------------------------- . 2020-10-01 15:03:04.858 WinSCP Version 5.15.9 (Build 10071) (OS 10.0.14393 - Windows Server 2016 Standard) . 2020-10-01 15:03:04.858 Configuration: nul . 2020-10-01 15:03:04.858 Log level: Normal . 2020-10-01 15:03:04.858 Local account: . 2020-10-01 15:03:04.858 Working directory: E:\Program Files\WinSCP . 2020-10-01 15:03:04.858 Process ID: 2568 . 2020-10-01 15:03:04.858 Command-line: "E:\Program Files\WinSCP\winscp.exe" /xmllog="C:\Users\sngfiletran\AppData\Local\Temp\wscp1820.031BB474.tmp" /xmlgroups /xmllogrequired /nointeractiveinput /dotnet=5.15.9 /ini=nul /log="F:\WinscpLogs\CONCENTRA_PORTFOLIO_RPTS_SessionLog.txt" /console /consoleinstance=_6176_57665189_176 . 2020-10-01 15:03:04.858 Time zone: Current: GMT-6, Standard: GMT-7 (Mountain Standard Time), DST: GMT-6 (Mountain Daylight Time), DST Start: 3/8/2020, DST End: 11/1/2020 . 2020-10-01 15:03:04.858 Login time: Thursday, October 1, 2020 3:03:04 PM . 2020-10-01 15:03:04.858 -------------------------------------------------------------------------- . 2020-10-01 15:03:04.858 Script: Retrospectively logging previous script records: > 2020-10-01 15:03:04.858 Script: option batch on < 2020-10-01 15:03:04.858 Script: batch on < 2020-10-01 15:03:04.858 Script: reconnecttime 120 > 2020-10-01 15:03:04.858 Script: option confirm off < 2020-10-01 15:03:04.858 Script: confirm off > 2020-10-01 15:03:04.858 Script: option reconnecttime 120 < 2020-10-01 15:03:04.858 Script: reconnecttime 120 > 2020-10-01 15:03:04.858 Script: open ftp://:990 -implicit -certificate="f1:c0:d4:c4:f8:b7:fe:47:65:f9:62:ad:1b:21:d1:d9:35:64:53:e1" -passive=1 -timeout=15 . 2020-10-01 15:03:04.858 -------------------------------------------------------------------------- . 2020-10-01 15:03:04.858 Session name: (Ad-Hoc site) . 2020-10-01 15:03:04.858 Host name: (Port: 990) . 2020-10-01 15:03:04.858 User name: (Password: Yes, Key file: No, Passphrase: No) . 2020-10-01 15:03:04.858 Transfer Protocol: FTP . 2020-10-01 15:03:04.858 Ping type: Dummy, Ping interval: 30 sec; Timeout: 15 sec . 2020-10-01 15:03:04.858 Disable Nagle: No . 2020-10-01 15:03:04.858 Proxy: None . 2020-10-01 15:03:04.858 Send buffer: 262144 . 2020-10-01 15:03:04.858 UTF: Auto . 2020-10-01 15:03:04.858 FTPS: Implicit TLS/SSL [Client certificate: No] . 2020-10-01 15:03:04.858 FTP: Passive: Yes [Force IP: Auto]; MLSD: Auto [List all: Auto]; HOST: Auto . 2020-10-01 15:03:04.858 Session reuse: Yes . 2020-10-01 15:03:04.858 TLS/SSL versions: TLSv1.0-TLSv1.2 . 2020-10-01 15:03:04.858 Local directory: default, Remote directory: home, Update: Yes, Cache: Yes . 2020-10-01 15:03:04.858 Cache directory changes: Yes, Permanent: Yes . 2020-10-01 15:03:04.858 Recycle bin: Delete to: No, Overwritten to: No, Bin path: . 2020-10-01 15:03:04.858 Timezone offset: 0h 0m . 2020-10-01 15:03:04.858 -------------------------------------------------------------------------- . 2020-10-01 15:03:04.967 Connecting to server:990 ... . 2020-10-01 15:03:04.967 Connected with server:990, negotiating TLS connection... . 2020-10-01 15:03:05.561 Verifying certificate for "Celero Solutions Inc." with fingerprint 3b:fe:bb:d0:d1:59:26:ba:a3:3d:f0:e8:59:b5:c7:55:82:00:05:56 and 20 failures . 2020-10-01 15:03:05.561 Certificate common name "server" matches hostname . 2020-10-01 15:04:05.638 Certificate failed to verify against Windows certificate store: Error: 80092013, Chain index: 0, Element index: 0 . 2020-10-01 15:04:05.638 Asking user: . 2020-10-01 15:04:05.638 **The server's certificate is not known. You have no guarantee that the server is the computer you think it is.** . 2020-10-01 15:04:05.638 . 2020-10-01 15:04:05.638 Server's certificate details follow: . 2020-10-01 15:04:05.638 . 2020-10-01 15:04:05.638 Issuer: . 2020-10-01 15:04:05.638 - Organization: Sectigo Limited, Sectigo RSA Organization Validation Secure Server CA . 2020-10-01 15:04:05.638 - Location: GB, Greater Manchester, Salford . 2020-10-01 15:04:05.638 . 2020-10-01 15:04:05.653 Subject: . 2020-10-01 15:04:05.653 - Organization: organization, server . 2020-10-01 15:04:05.653 - Location: locaation . 2020-10-01 15:04:05.653 - Other: other; . 2020-10-01 15:04:05.653 . 2020-10-01 15:04:05.653 Valid: 1/27/2020 12:00:00 AM - 1/26/2021 11:59:59 PM . 2020-10-01 15:04:05.653 . 2020-10-01 15:04:05.653 Fingerprint (SHA-1): 3b:fe:bb:d0:d1:59:26:ba:a3:3d:f0:e8:59:b5:c7:55:82:00:05:56 . 2020-10-01 15:04:05.653 . 2020-10-01 15:04:05.653 Summary: Unable to get local issuer certificate. The error occurred at a depth of 2 in the certificate chain. . 2020-10-01 15:04:05.653 . 2020-10-01 15:04:05.653 If you trust this certificate, press Yes. To connect without storing certificate, press No. To abandon the connection press Cancel. . 2020-10-01 15:04:05.653 . 2020-10-01 15:04:05.653 Continue connecting and store the certificate? ()
Any ideas?
