FTP SSL/TLS certificate handling

[graxlop]

Hello,

Would you consider the idea of changing how self-signed aka "untrusted" certificates are handled? Currently, they just hardfail if they aren't signed by a trusted certificate authority, but I think it might be a good idea to have a dialog prompting a yes/no with the certificate fingerprint being shown, this would allow users to accept or reject based on checking the fingerprint, rather than blindly trusting the CA system.

I've noticed that many users simply disable all forms of verification (set ssl:verify-certificate false) when they come across a self-signed certificate, so I can only see this as a security improvement.

Thanks

[lavv17]

Unfortunately, lftp is designed in a fashion of not asking any questions. The only question it asks is about password when logging in (well, maybe for the proxy password too). In these cases the question is expected by the user and is caused by user's action. I don't want lftp to ask questions caused by server's replies.

OTOH, it may be useful to add some certificate details in the error message. Currently they are only output in the debug.

[graxlop]

In the case of a self-signed certificate, the user already has to make a decision based on the server's replies, either disable verification (most likely to happen), or choose not to connect at all.

I think it would only be of benefit to provide a yes/no prompt in such cases. Otherwise, you end up in a situation where the user is blindly accepting a self-signed certificate with no way of validating it against the fingerprint.

This type of behavior also prevents secure FTP over TLS when connecting to an IP address directly, as you can't obtain a CA-signed certificate for an IP address.

[lavv17]

I'll add the certificate fingerprint to the error message and allow disabling strict verification for a single certificate by its fingerprint.

[lavv17]

Please try 7270538

[graxlop]

The fingerprint shows up, but I don't see the option to allow it.

[lavv17]

set ssl:verify-certificate/FI:NG:ER:PR:IN:T:HE:RE no

[graxlop]

Looks good, thanks.

[sebma]

@lavv17 Thanks, I just added that into my ~/.lftprc.