Forum » Feature Requests »

Post a reply

Options
Add an Attachment

If you do not want to add an Attachment to your Post, please leave the Fields blank.

(maximum 10 MB; please compress large files; only common media, archive, text and programming file formats are allowed)

Options

Topic review

martin

Re: SSL support

@ljakobs: Sent.
ljakobs

SSL support

Can you please send me the 5.8 dev version too for the same reason FTPS with certs.
martin

Re: Pls send dev version.

@TomVS: Sent.
Tom VS

Pls send dev version.

Hi prikryl,

Can you please send me the 5.8 dev version too for the same reason FTPS with certs.

Thanks,
Tom
martin

@ftpuser: Sent.
ftpuser

Hi Can I have the dev version also as I have a need for this via C#. Thanks
martin

@BCH: WinSCP supports file certificates only.
Anyway, I have sent you an email with a development version of WinSCP to address you have used to register on this forum.
BCH

Hello,
I also am working on a particular use case with a need for client certs on implicit FTPS connections.

If possible, I'd like to test the 5.8 version for our particular case: cert and its key are located either on a smart-card, or a USB dongle.

Thanks a lot!
Marty

Re: What kind of certificate and private key format is WinSCP execting?

@martin: What a pity. It works like a charm.

I read the following:
Difference between SSH and SSL | Difference Between | Difference between SSH vs SSL

SSL means “Secure Sockets Layer”. Many protocols — like HTTP, SMTP, FTP, and SSH ‘“ were adjusted to include the support of SSL. Basically, it works as a tier in a certain protocol to provide cryptographic and security functions.

The combination of certificates and SSH is very powerful. There is no need any more for users to copy their public keys to the server. The Certificate issuer (CA / signer) can make the certificate valid for a limited time period. SSH options can be allowed or disallowed per certificate. It's great.
Marty

Re: What kind of certificate and private key format is WinSCP execting?

martin wrote:

The client certificates are for TLS/SSL (FTPS, WebDAVS), not for SSH/SFTP.

I'm trying to make an SFTP connection with a server signed client certificate.
I've already tested it, and it works on Linux with: 
sftp -i <client_key> [email protected]

The Linux sftp client expects the following naming convention in order for the client to pick up the certificate and its complementary private key:
<client_key> (private key)
<client_key>.pub (public key)
<client_key>-cert.pub (CA signed public key)

How does it work with WinSCP (version 20150710r)?
I expect it will be needing access to the certificate and its private key.
How do I have to supply those?
(BTW The SFTP server only allows authentication with client certificates.)
martin

Re: What kind of certificate and private key format is WinSCP execting?

@Marty: The client certificates are for TLS/SSL (FTPS, WebDAVS), not for SSH/SFTP.

For SSH/SFTP, you use private keys, which WinSCP always supported (-privatekey).

You just have to convert the key to .ppk format.

Use PuTTYgen:
https://beta.winscp.net/eng/docs/ui_puttygen
Marty

What kind of certificate and private key format is WinSCP execting?

What kind of certificate and private key format is WinSCP (version 20150710r) expecting?

When I try it with OpenSSH generated keys, I get the following: 
winscp> open sftp://[email protected] -clientcert=G:\Keystore\client_key-cert.pub -privatekey=G:\Keystore\client_key

Searching for host...

Connecting to host...

Authenticating...

Unable to use key file "G:\Keystore\client_key" (OpenSSH SSH-2 private key)

Using username "marty".

Disconnected: No supported authentication methods available (server sent: publickey)

Authentication log (see session log for details):

Unable to use key file "G:\Keystore\client_key" (OpenSSH SSH-2 private key)

Using username "marty".



Authentication failed.
martin

@jdantzler: Sent.
jdantzler

I'd like to test it out too if possible? Thanks.
martin

Re: test certificate authentication

@ebstc: Sent.