FtpWebRequest EnableSSL error

Question

I'm getting a "The remote certificate is invalid according to the validation procedure" exception message with the following code:

ServicePointManager.ServerCertificateValidationCallback = new RemoteCertificateValidationCallback(MyCertValidationCb);

var request = (FtpWebRequest)WebRequest.Create(new Uri(myUri));
request.EnableSsl = true;
request.Method = WebRequestMethods.Ftp.UploadFile;
request.BeginGetRequestStream(EndGetStreamCallback, _state);


public static bool MyCertValidationCb(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
{
    if ((sslPolicyErrors & SslPolicyErrors.RemoteCertificateChainErrors)
              == SslPolicyErrors.RemoteCertificateChainErrors)
    {
        return false;
    }
    if ((sslPolicyErrors & SslPolicyErrors.RemoteCertificateNameMismatch)
        == SslPolicyErrors.RemoteCertificateNameMismatch)
    {
        Zone z;
        z = Zone.CreateFromUrl(((FtpWebRequest)sender).RequestUri.ToString());
        if (z.SecurityZone == SecurityZone.Intranet
            || z.SecurityZone == SecurityZone.MyComputer)
        {
            return true;
        }
        return false;
    }
    return false;
} 

The ftp server is filezilla. FTP over SSL is enabled, and Allow explicit FTP over TLS is also enabled. I've generated a certificate.crt file. Connected to the ftp location using filezilla client, and checked "Always trust this certificate" in the popup window.

In the MyCertValidationCb method, (sslPolicyErrors & SslPolicyErrors.RemoteCertificateChainErrors) == SslPolicyErrors.RemoteCertificateChainErrors is always true.

If I change MyCertValidationCb to always return true, the ftp request goes through without a problem. I'm sure it's an issue with certificates. Anyone have any ideas?

Answer 1

The RemoteCertificateChainErrors was a result of not having the certificate in the Trusted Root Certification Authorities certificate store.

Filezilla generates a self signed certificate with the following format:

-----BEGIN RSA PRIVATE KEY-----

//hash

-----END RSA PRIVATE KEY-----

-----BEGIN CERTIFICATE-----

//hash

-----END CERTIFICATE-----

In order to import the certificate, remove the private key section and save the new file. Install that into the Trusted Root Certification Authorities certificate store.

Now the issue I'm having is RemoteCertificateNameMismatch, I'll post that in another topic.