FTP over SSL generates a RemoteCertificateNameMismatch error

Discussion in 'General troubleshooting' started by Some1, Jan 14, 2015.

  1. Reproduce with:

    public static string DirectoryList(string url, string username, string password)
    {
    ServicePointManager.ServerCertificateValidationCallback = OnCertificateValidation;
    string result = "";
    FtpWebRequest request = (FtpWebRequest)WebRequest.Create(url);
    request.Timeout = 5000;
    request.UsePassive = true;
    request.EnableSsl = true;
    request.Method = WebRequestMethods.Ftp.ListDirectory;
    request.Credentials = new NetworkCredential(username, password);
    using (FtpWebResponse response = (FtpWebResponse)request.GetResponse())
    using (StreamReader reader = new StreamReader(response.GetResponseStream()))
    result = reader.ReadToEnd();
    return result;
    }

    static bool OnCertificateValidation(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
    {
    if (sslPolicyErrors == SslPolicyErrors.None) return true;
    else throw new Exception(certificate.Subject);
    }

    Use with the following url type (not your site's "regular" url): ftp://ftp.---.web---.discountasp.net/

    This should NOT generate an error because the subject of the certificate is *. discountasp.net .

    (Is there any way to format code on this forum?)
     
    Last edited: Jan 14, 2015
  2. martino

    martino DiscountASP.NET Staff

    What is the full error message you're getting?

    Just wondering, did you install an SSL Certificate for your site account and then we made it so you can only connect to your site via FTP over SSL?
     
  3. That's the full error: a value of an enum: SslPolicyErrors.RemoteCertificateNameMismatch.

    We did have an ssl certificate installed for our site, but I don't have reason to believe that the second part is correct. I can connect without SSL. In fact, when contacting support, all they told me is that it should work, and that they can't provide support for programming etc.

    Did you try the code? Does it work for any site?
     
  4. martino

    martino DiscountASP.NET Staff

    I don't know how to use your code because I don't code myself.

    However, one thing I do know is when our customer use FTP over SSL via FTP in our hosting environment we tell them to use the option "Require Explicit FTP Over TLS". https://support.discountasp.net/kb/a318/how-to-set-up-filezilla-to-use-ftp-over-ssl.aspx

    One thing I did find was this web page article here: https://social.msdn.microsoft.com/F...7438d59/ftp-enablessl-error?forum=Vsexpressvb

    There was some brain storming from one person on that web page article how it works via Require Explicit FTP over TLS on FileZilla and how it doesn't work with Implicit. May your code tries to connect via Implicit by default ? I have no idea for sure but something to think about within our hosting environment.
     
  5. No. All .net code (including my code above) is only explicit as far as I know. (Mentioned here: https://social.msdn.microsoft.com/F...over-ssl#0579cd59-3a82-42be-aace-d47ab104603d .)

    I'm wondering what happens when other people try this. Do they get that error as well? (As far as I know you don't have to have SSL on your site to try this. Ftp has a certificate by Discountasp.net.)
     
  6. martino

    martino DiscountASP.NET Staff

    In this case I believe that the SSL Certificate is failing.

    I know when I tried using FTP over SSL in our hosting environment with FileZilla and I set up all the correct settings. The FTP client will issue warning as in "Unknown Certificate". To resolve this we place a check next to "Always Trust Certificate in future sessions" and click on "OK".

    Once we click on the OK button we are able to connect via SSL certificate and the connection is accepted.

    I'm wondering if you're code will just fail if this issue pops up. Is there a way for you in your code to accepted the SSL certificate before it fails via your code?

    I found this article but not sure if it will help: http://forums.asp.net/t/1455005.aspx?Accept+all+certificates+using+FTP+SSL+
     
    mjp likes this.
  7. Yes. Simply return "true" from the OnCertificateValidation method. But that's not secure.
    The error shouldn't be happening at all.
     

Share This Page