Page 1 of 1

Linux client problem with DST Root CA X3

Posted: 2022-01-07 17:19
by crawford-b
Hello. When using Filezilla on Windows to access my Siteground ftp server, I have no problems. When using Filezilla on Linux (RHEL8) I can access the server, but only after being warned about the expiry of the DST certificate every time, repeatedly. I understand the DST problem and I asked Siteground to remove the long chain from their servers but they said their servers were fine and they didn't want to change anything. For some reason, the Linux Filezilla client isn't as tolerant as the Windows client, and will not let me click "Always accept..." In a sense, Filezilla is doing its job correctly to warn about the expiry, but how come it only does it on Linux? I have to click to accept the certificate on almost every operation, not just on logging in, and it's becoming annoying! I would appreciate any guidance. Screenshots attached. Thank you.

Re: Linux client problem with DST Root CA X3

Posted: 2022-01-10 13:50
by botg
The expired certificate is in your system trust store, usually at /etc/ssl/certs. Remove it from there.

Re: Linux client problem with DST Root CA X3

Posted: 2022-01-10 15:30
by crawford-b
That did it! Thank you very much.
I had already attempted to remove the DST Root CA from my trust store but the command trust anchor --remove... didn't work.
This time I opened ca-bundle.trust.p11-kit in vim and manually deleted the DST entry, ran update-ca-trust extract and now Filezilla is happy.
Thank you.