Re: FTPS using self-signed certificate

[Scott Klement <midrange-l@xxxxxxxxxxxxxxxx>]

The only reason that your system allows certificates signed by VeriSign 
and Thawte is because IBM installed the CA certificates for those 
companies into the DCM.

Same with a browser... those companies are trusted because the browser 
came with the certificate authority (CA) certificates already installed.

Therefore, anything that's signed by those CA certificates is 
"trustworthy".

If you don't want to pay those companies to sign your certificates, what 
can you do?  Create your owne certificate authority (CA) certificates, and 
insstall them into the DCM and/or browsers that need to trust them.  That 
way, any certificates signed by your newly-created CA will be trusted as 
well.

---
Scott Klement  http://www.scottklement.com

On Tue, 6 Dec 2005, Douglas Handy wrote:

> I'm trying to establish an implicit FTPS session to a host which is
> providing a self-signed certificate.  Upon connection, I get error TCP3D2C
> (Secure connection error, return code -23) and the help text for -23 is
> "Certificate is not signed by a trusted certificate authority"
>
> Is there any way to configure it to accept a self-signed certificate?  I
> have CHGFTPA set to ALWSSL(*YES).
>
> The goal is just to get encryption on FTP transfers to a static IP host site
> used for staging files, so having a trusted certificate authority issued
> certificate doesn't seem like it should be necessary.  Although I admit DCM
> is an area where i have no experience yet.