Certificate chains and the verification thereof

Does SmartFTP read all the certificates sent by a server? It doesn't seem so.

I connect to a server which has a certificate signed by an intermediate CA, which is in turn signed by a trusted root CA whose certificate is installed as such in Windows' certificate repository, which SmartFTP uses.

The server (a lightly patched vsftpd) sends its own cert and that of the intermediate CA, as it should. I've verified this using the gnutls-cli, the GNU TLS test client, and both CoreFTP and FileZilla verify the certificate chain OK.

However, if I double-click the padlock icon to bring up the certificate details it says "/! Windows doesn't have enough information to verify this certificate" and only the server's own certificate is shown on the certification path tab. If I install the intermediate cert in the repository, all three certs are of course listed.

+- System -----------------------------

Microsoft Windows 2000 Professional
Service Pack 4 (Build 2195)

CPU Speed : 447 MHz
Total Memory : 523824 KB
Free Memory : 135808 KB

+- SmartFTP ---------------------------

Version : 1.1.985.6
Time Stamp : 2005-03-23 18:28:17
Language ID : 0x0409
Language File : ResEng.dll

+- Application DLL --------------------

controls.dll : 1.6.985.6
ftpapi.dll : 2.0.985.6
language.dll : 1.0.985.6
reseng.dll : 1.3.985.6
+- System DLL -------------------------

shell32.dll : 5.00.3900.7032
shlwapi.dll : 6.00.2800.1612 (xpsp2.041207-1145)
comctl32.dll : 5.81
riched20.dll : 5.30.23.1215
schannel.dll : 5.00.2195.6899

+- Internet Explorer ------------------

Version : 6.0.2800.1106

+- Winsock ----------------------------

Winsock : 2.2

Hello ...

Do you have a public FTP server which returns a certificate with the complete cert chain?

I reviewed the SSL/TLS code but I was unable to find any flag to request the full cert chain. I'm not even sure if the server returns the complete chain and SmartFTP just doesn't display all of of them.

Thank you for your time.
-Mat

The server in question is fryken.frryd.se. (You can't log in, but you can test negotiating SSL/TLS.)

It could be a bug in Windows too.

Hello ...

Whether CoreFTP nor Filezilla does display the full certificate chain. Furthermore I doubt they verify it. Filezilla displays the following summary in the cert dialog : "Unable to get local issuer certificate. The error occured at a depth of 2 in the certificate chain".

My guess is that the server doesn't send the full certificate chain.

-Mat

FileZilla uses OpenSSL and you have to put the root certificate in the file cacert.pem in the same directory as filezilla.exe. If you do, FileZilla no longer complains. "The error occured at a depth of 2 in the certificate chain" indicates that FileZilla got 2 certificates.

Unfortunately, neither FileZilla nor CoreFTP displays the full certificate chain, but I can tell from their behaviour wether the verification was OK.

(The root certificate is http://www.unit.liu.se/services/ca/beca-root-pem.crt)

If you convert the crt (you can use openssl) and import it in windows (cert manager) you get the same behavior. Then the cert dialog in SmartFTP displays the full cert chain ;-)

-Mat