Filezilla issue after update

[ianhaney]

Hi

A update popped up on Filezilla so did the update and now I can't connect to the FTP where as before I could

the message I get is below

Received certificate chain could not be verified. Verification status is 66.
Error: Could not connect to server

The setting is currently set to use explicit FTP over TLS if available as the encryption, if I change it to only use plain FTP(insecure) it works and connects but worried in case it's not secure

Has anyone had this issue before and if so how to solve it

Thank you in advance

[botg]

That's strange. What's the address of the server you are trying to connect to?

My first guess is that the server sends a wrongly sorted certificate chain.

[ianhaney]

Do you mean the host, if so it is ftp.broadwaymediadesigns.co.uk

[botg]

Yes, the certificate chain sent by the server is indeed malformed.

During the TLS handshake the server sends its certificate and a chain of issueing certificates. If the chain contains three certificates, say A, B and C, then A must be signed by B and B must be signed by C. Your server sends a chain where A is signed by C and C is signed by B.

Please contact your server administrator or server hosting provider for assistance to have the server's certificate chain fixed.


For reference, see https://tools.ietf.org/html/rfc5246#page-48:

certificate_list
This is a sequence (chain) of certificates. The sender's
certificate MUST come first in the list. Each following
certificate MUST directly certify the one preceding it.

[ianhaney]

Will do, I'll contact them now

Thank you for your help and replies, appreciate it

[savvygents]

Having the same problem after update - it was working right before I updated.

[savvygents]

Update: My partner that has not yet updated to the new version can connect perfectly. So def something with the new update.

[ianhaney]

I thought that too, I spoke to my hosting and only way around it at the mo is to use the plain FTP as encryption as long as the password is safe and not a easy one to guess so it can't be hacked or anything

[botg]

The new version of FileZilla is more strict about certificate chain verification and now rejects such malformed chains.

I spoke to my hosting and only way around it at the mo is to use the plain FTP as encryption

I know another way that doesn't compromise on security: It's your hosting provider fixing the server configuration so that it presents a well-formed chain. For most servers it's a dead trivial task, only a few lines in a text file need to be swapped around.

[ianhaney]

Oh right will ask them about that now

[boco]

at the mo is to use the plain FTP as encryption as long as the password is safe and not a easy one to guess so it can't be hacked or anything

Since Plain FTP is no encryption at all, your safe and non-guessable password is sent in clear text over the wire/ether. Everyone can easily intercept and even modify traffic (routers and firewalls do that all the time). So much for the hacking.

[savvygents]

UPDATE: Just reinstalled the cert for the server (FTP Services) and it is now working as intended.

Note we are using WHM/CPanel

[mikelade]

I am also getting
Command: AUTH TLS
Response: 234 AUTH TLS OK.
Status: Initializing TLS...
Error: Received certificate chain could not be verified. Verification status is 66.
Error: Could not connect to server

after the upgrade this morning !

What do I need to do? Running Windows 10 on a PC

[botg]

I am also getting
Command: AUTH TLS
Response: 234 AUTH TLS OK.
Status: Initializing TLS...
Error: Received certificate chain could not be verified. Verification status is 66.
Error: Could not connect to server

after the upgrade this morning !

What do I need to do? Running Windows 10 on a PC

Please contact your server administrator or server hosting provider for assistance to have the server's certificate chain fixed.

[halsil]

I have this same problem. I risked my password to upload urgent data.

Even if I could correctly ask for a change, it would still take a few days for my provider to implement it.

It appears that many, many servers send certificates wrongly and many of FileZilla's users are being asked to contact their FTP providers with a request that they do not understand.

Perhaps Filezilla could provide a standard wording for our requests for servers to follow the correct rules?

And also back out this change until we have had a chance to ask our providers to comply?