TLSv1 Connection

[dedomil]

Hi bigstar,

can you help me? I have problem with connection on one server. I can't connect on that FTP.

I think have some problem with certificate. For test I try WinSCP and this software can accept that wrong certificate but FlashFXP don't accept. I trying many options in SSL tab but nothing works.

I using FlashFXP v5.4.0 (build 3956)

----- Fixed -----

I renamed libcrypto-1_1.dll on libcrypto-1_1.dll-bak and libssl-1_1.dll on libssl-1_1.dll-bak and now certificate PopUp and I accept him.

[bigstar]

Are you using a client certificate?

This error can occur when the wrong client certificate is used.

[dedomil]

Yeah I say that server administrator about wrong certificate but he say I have problem with FXP haha :D

[bigstar]

Thank you for the update.

When FlashFXP starts up what version of OpenSSL does it report in the status window.

You don't need to rename any of the dll files, you can switch the version using a custom command

Ctrl+R or From the main menu > Command > Raw Command

To use OpenSSL 1.1.0 use the command
/set app.openssl 1.1.0To use OpenSSL 1.0.2 use the command
/set app.openssl 1.0.2Then restart FlashFXP

There might be an unknown error with client certificates when using OpenSSL 1.1.0, I will look into this and let you know what I find.

[dedomil]

/set app.openssl 1.0.2 works. Thanks bigstar ;)

[bigstar]

Is there any documentation or information on using client certificates (x.509 authentication) with glftpd?

I am not finding any details on how to setup this type of test environment.

I have an idea of why this probably doesn't work with OpenSSL 1.1.0 but I need to actually test it to confirm my suspicion.

[dedomil]

I don't know nothing about configuration that ftp server sorry :/

[bigstar]

I suspect that the problem might be a combination of a specific server configuration combined with the older version of glftpd.

I was not able to reproduce the problem using the same version of glftpd or even newer versions.

While using OpenSSL 1.0.2 will remedy the problem for now, this may not always be an option. i.e. when it no longer receives security updates.