Re: Explicit FTP over TLS support

Hi Bob,

-93 means that SSL is not available for use. (If run it interactively, and hit help on the message, it'll tell you what the codes mean.)

In case you weren't aware, SSL is the old name, TLS is the new name, but they mean the same thing. (More or less.)

FWIW, in TLS/SSL programming, -93 corresponds to the constant SSL_ERROR_SSL_NOT_AVAILABLE in the original SSL API suite, which IBM appears to still use for their FTP client.

Anyway, here's what I'd do:

1) Make sure SSL is installed.

2) Make sure that you have (at a minimum) created the *SYSTEM certificate store configured with it's default CA certificates.

3) Make sure the SSL App IDs didn't get jagged up somehow. (I've seen this happen during system migrations.)

-SK



On 2/10/2012 8:20 AM, Bob Cagle wrote:

Scott

I will be acting as a client and PUTting the file on their system. I
already had a simple batch FTP routine that just uses plain FTP. I am
attempting to modify it use this 'Explicit FTP over TLS'; just not sure
what parms to use.

I have tried all the combinations available on the FTP command parms -
SECCNN and DTAPROT - to no avail. I keep getting the message ' Secure
connection error, return code -93.' I haven't been able to locate what
-93 means yet. That's what had me thinking maybe I need a certificate,
but:

The partner did send instructions on how to setup and use Filezilla to
transfer the file, and the encryption setting in that software is
'Require explicit FTP over TLS'. That setup does work and I can connect
to their FTP site using Filezilla without having to utilize any sort of
digital certificate.

Just can't get the i FTP client to connect...

Thanks
Bob

From: Scott Klement
Sent: Thursday, February 09, 2012 5:29 PM

Hi Bob,

Yes, the FTP client and FTP server that are provided with IBM i do, in

fact, support explicit FTP over TLS. (But, if you are running different
FTP software aside from the stuff that comes with the OS, then>you need
to ask this question about that software, specifically. TLS
functionality is not a feature of the platform, it's a feature of the
software you're running.)

You did not say whether you are acting as a client or server, though.
But it seems awfully strange to have to set up the partner's

certificate on your system?? The only reason I'd do that is if
client-side certificates are required. Unless you mean a CA certificate?

But, if you do require client-side certificates (which is a separate

matter than 'explicit TLS', and are not required in 95% of the cases)
then ... last I checked, anyway .. the client-side certificate support
in>the IBM i FTP client wasn't very good.