3

Today most hosting providers start a TLS connection whenever you connect to their FTP server. But Filezilla doesn't store any root certificates, so whenever you connect to an FTP server and the TLS connection is started, you get this message:

The server's certificate is unknown. Please carefully examine the certificate to make sure the server can be trusted.

Then there are some details about the certificate: fingerprint, subject, issuer, etc. It is also possible to see the details of the other certificates in the chain, up to the root certificate. I don't see any way to download the whole certificates though, but I might be wrong. Filezilla just asks me: "trust this certificate and carry on connecting?" So I'd like to know what I should do to make sure I can trust it.

Here are the screenshots for more information. Under those windows the only buttons are "ok" or "cancel" (not included in the screenshots). Note the first is "certificate in chain #0", then there's #1 and #2. From what I understand, in this example the root certificate should be "AddTrust External CA Root".

first certificate second certificate third certificate

Improve this question

1 Answer 1

Reset to default
3

FileZilla never automatically trusts certificates.

You mention a chain of trust, but not much about the root certificate. Does it seem like one that should be trusted? You could compare the fingerprint of the provided root certificate to one in the certificate trust store on your local machine. This would emulate the basic/default behavior for most TLS clients, to trust the client because you trust the CA.

To be particularly fastidious you could contact the owner of the FTP server and ask what the fingerprint of their certificate is. When connecting, if the presented certificate has the correct fingerprint and you trust it, your future connections will henceforth be secure from MITM attacks.

Supposing the FTP owner is not particularly helpful, another way to increase trust would be to observe the certificate fingerprint over an extended period of time using several different internet connections and devices. If you only ever see a single key fingerprint it would indicate that either nobody is attempting an MITM attack or that they are successfully doing so every time you connect. Supposing you are an optimist, trust the key with this fingerprint.

Improve this answer
10
  • I actually don't know what Filezilla does exactly, only what I see. It shows me a chain of certificates, and I suppose they are all provided by the FTP server I'm connecting to. But I don't know if Filezilla is actually verifying that chain. Also, I'm afraid the actual root certificate isn't included, because the last certificate up the chain has a root CA as the issuer, but the subject of the certificate is different, so I guess that is not the actual root certificate, and I can't compare it to one I already have and trust (I tried, fingerprints differ).
    – reed
    Commented Nov 24, 2018 at 11:45
  • @reed can you add a screenshot of the certificate trust chain to your question?
    – le3th4x0rbot
    Commented Nov 24, 2018 at 14:02
  • Ok, I added the screenshots of the window that appears in FileZilla.
    – reed
    Commented Nov 24, 2018 at 14:57
  • @reed Is the sha1 fingerprint of certificate #2 afe5d244a8d1194230ff479fe2f897bbcd7a8cb4 ?
    – le3th4x0rbot
    Commented Nov 24, 2018 at 21:45
  • No, I don't see that string anywhere. How did you come up with that?
    – reed
    Commented Nov 25, 2018 at 15:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .