[FAQ] Verifying the Host Certificate in Script with CA certificate / custom CA

Lately I’ve been working on setting up a file server on an Amazon ec2 instance with ProFTPD so that I can upload files using FTPS/SFTP. I had some issues getting FTPS to work correctly despite using a Rapid SSL certificate from GeoTrust that I purchased. I attempted first with FileZilla, and then with WinSCP but both gave me the below error and had problems verifying my SSL certificate.

Unable to get local issuer certificate. The error occurred at a depth of 2 in the certificate chain.

...here some text is cut out...

By looking into the WinSCP code we can check exactly how it is verifying the SSL certificate:
filezilla/AsyncSslSocketLayer.cpp:

      if (clientMode)
      {
         USES_CONVERSION;
         pSSL_CTX_set_verify(m_ssl_ctx, SSL_VERIFY_PEER, verify_callback);
         pSSL_CTX_load_verify_locations(m_ssl_ctx, T2CA(m_CertStorage), 0);
      }

filezilla/AsyncSslSocketLayer.cpp:

BOOL CAsyncSslSocketLayer::SetCertStorage(CString file)
{
   m_CertStorage = file;
   return TRUE;
}

filezilla/FtpControlSocket.cpp:

      m_pSslLayer = new CAsyncSslSocketLayer;
      AddLayer(m_pSslLayer);
      TCHAR buffer[1000];
      GetModuleFileName(NULL, buffer, 1000);
      CString filename = buffer;
      int pos = filename.ReverseFind(_MPT('\\'));
      if (pos != -1)
      {
         filename = filename.Left(pos + 1);
         filename += _T("cacert.pem");
         m_pSslLayer->SetCertStorage(filename);
      }
      else
         filename = _MPT("cacert.pem");

So WinSCP uses OpenSSL to verify certificates, the function pSSL_CTX_load_verify_locations specifies the location of trusted CA certificates. In this instance we can see that it uses a file called cacert.pem in the same location as the running module.

Basically WinSCP does not come with pre-trusted certificates, which is preferable for security reasons but a bit inconvenient as I couldn’t find this information documented. The only information I could find was this which implied that the certificates from the Windows store would be used, and I definitely had the GeoTrust root certificate there.

To fix this I added all the Firefox CAs from https://curl.se/docs/caextract.html

Just download cacert.pem from the above link and place it into the same folder as winscp.exe, then when you try to connect to the server with FTPS that has your certificate you shouldn’t get any certificate warnings.

Makc666 wrote:

after all investigations I expect that WinSCP does NOT use Windows Certificate Storage.

If the source code from the above link is actual then is it really that cacert.pem file is the only place where WinSCP is looking for trusted CA certificates?

If all points above are done correctly you don't have to use -hostkey="<fingerprint>" or -certificate="<fingerprint>" (I didn't test -hostkey but I expect it to work) for FTPS/SFTP.

martin wrote:

WinSCP DOES USE Windows Certificate store.

martin wrote:

No. Use of the cacert.pem was deliberately never documented. It's not recommended for use.

martin wrote:

SFTP/SSH does not use certificates. So all this is irrelevant for SFTP/SSH.

Makc666 wrote:

In which part of the Store then I have to put them?
Where WinSCP is looking for those certificates then – in Global storage, Users storage, or may be in some other?

@sessionlog@
. 2017-02-06 15:38:00.824 Certificate failed to verify against Windows certificate store: Error: 800B0109, Chain index: 0, Element index: -1

@sessionlog@
. 2017-02-06 17:02:40.025 Certificate failed to verify against Windows certificate store: Error: 80092013, Chain index: 0, Element index: 0

The IP Helper service depends on the WinHTTP Web Proxy Auto-Discovery Service service which failed to start because of the following error:
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

The Network Connectivity Assistant service depends on the IP Helper service which failed to start because of the following error:
The dependency service or group failed to start.

. 2017-02-13 15:47:41.487 Certificate verified against Windows certificate store