The server's certificate is not known :: Support Forum

srs44 Guest

The server's certificate is not known

2025-03-19 11:50

WinSCP version 6.3.7

When I use WinSCP command line:

winscp.com /command "open ftpes://zzzz1:ZZZzzzz%23%2F@Tools-n-Gizmos.com/"

Progress window =

Connecting to Tools-n-Gizmos.com ...
TLS connection established. Waiting for welcome message...
Connected
Starting the session...
Session started.
Active session: [1] zzzz1@Tools-n-Gizmos.com
winscp>

When I run script:

open ftpes://zzzz1:ZZZzzzz%23%2F@Tools-n-Gizmos.com/

Progress window =

Connecting to Tools-n-Gizmos.com ...
The server's certificate is not known. You have no guarantee that the server is the computer you think it is.
Server's certificate details follow:
Issuer:
- Organization: Let's Encrypt, R11
- Location: US
Subject:
- Organization: agora.serverg.net
Valid: 1/21/2025 2:52:21 PM – 4/21/2025 2:52:20 PM
Fingerprints:
- SHA-256: bb:8d:25:99:c6:e1:fb:7f:98:4f:12:a1:a1:9a:dc:6b:83:df:b4:e8:7c:b2:20:dc:f4:c1:94:52:1e:cc:33:40
- SHA-1: e9:0e:26:00:9e:e0:72:3f:13:b5:4d:9b:4d:a1:4c:12:d9:6b:1e:18
Summary: Unable to get local issuer certificate. The error occurred at a depth of 2 in the certificate chain.
Certificate was not issued for this server. You might be connecting to a server that is pretending to be "Tools-n-Gizmos.com".
If you trust this certificate, press Yes. To connect without storing certificate, press No. To abandon the connection press Cancel.
Continue connecting and store the certificate?
(Y)es, (N)o, C(a)ncel (4 s), (C)opy Key:

If I press y then I get successful connection:

TLS connection established. Waiting for welcome message...
Connected
Starting the session...
Session started.
Active session: [1] zzzz1@Tools-n-Gizmos.com
winscp>

But WinSCP does not store the trusted certificate and everytime I run the script it hangs waiting for manual approval.

Reply with quote

martin◆ Site Admin
Joined:: 2002-12-10
Posts:: 41,853
Location:: Prague, Czechia

Re: The server's certificate is not known

2025-03-20

Please attach a full session log file showing the problem (using the latest version of WinSCP).

To generate the session log file, use /log=C:\path\to\winscp.log command-line argument. Submit the log with your post as an attachment. Note that passwords and passphrases not stored in the log. You may want to remove other data you consider sensitive though, such as host names, IP addresses, account names or file names (unless they are relevant to the problem). If you do not want to post the log publicly, you can mark the attachment as private.

Reply with quote

srs44@... Guest

Re: The server's certificate is not known

2025-03-24 01:21

I would love to provide a full session log file. But I can't get the log function to work.
I'm calling my script from Excel macro using the following, which works great and uploads files.

Call Shell("""C:\Program Files (x86)\WinSCP\WinSCP.com"" /ini=nul /script=""D:\$_My Stuff\@_Griz44\@Working\_Griz44\_Development\UploadScript.txt"" ")

When I add /log=C:\WinSCP.log switch, the script does not run correctly and no files are uploaded.

Call Shell("""C:\Program Files (x86)\WinSCP\WinSCP.com"" /log=C:\WinSCP.log /ini=nul /script=""D:\$_My Stuff\@_Griz44\@Working\_Griz44\_Development\UploadScript.txt"" ")

And no logfile is created

Reply with quote

martin◆ Site Admin

Re: The server's certificate is not known

2025-03-24

On Windows, you typically do not have write access to a C:\ root. Did you try other path?

Reply with quote

srs44@... Guest

Re: The server's certificate is not known

2025-03-24 21:34

Whoops, D:\ worked.
I will now put together a session with logfile of my connection "server certificate is not known" problem and get back to you.

Thanks

Reply with quote

srs44@... Guest

Re: The server's certificate is not known

2025-03-24 22:42

Ok, attached are 3 scripts and 3 log files

#1 is successful connection using -hostkey="*" switch which I'm using to refine my huge Script.
#2 is my original Script without -hostkey switch
#3 is one on many attempts I've made trying to provide the proper signature. Most likely I have a syntax problem but the solution is beyond me.

MyZip.zip (7.83 KB)

Reply with quote

martin◆ Site Admin
Joined:: 2002-12-10
Posts:: 41,853
Location:: Prague, Czechia

Re: The server's certificate is not known

2025-03-27

In general, you indeed should specify the certificate fingerprint using the -certificate switch (the -hostkey works too, but it's semantically incorrect). That's because the scripts should better run in isolated environment, not relying on certificate caches.

But in your commandline in your first post, you didn't use /ini=nul. So the caching should have worked. But now in the log I see that you actually use /ini=nul. That explains, why caching does not work.

As for the syntax: The SHA-256: prefix shouldn't be there.
So it should be like:

open ftpes://user:pass@Tools-n-Gizmos.com -certificate="bb:8d:25:99:c6:e1:fb:7f:98:4f:12:a1:a1:9a:dc:6b:83:df:b4:e8:7c:b2:20:dc:f4:c1:94:52:1e:cc:33:40"

Reply with quote