-1

All,

After installing the new cert from Comodo in my MS2012 server, my FTPS connections from my RHEL6 server are failing with "gnutls_handshake" error. We moved from Verisign signed to Comodo. I went through the different "set" commands but still unable to connect successfully. Can you please help? Thanks a bunch..

lx1234$ lftp
lftp :~> open -u uname ftps://server
Password:
lftp uname@server:~> set ftps:initial-prot ""
lftp uname@server:~> set ftp:ssl-force true
lftp uname@server:~> set ftp:ssl-protect-data true
lftp uname@server:~> set ssl:verify-certificate "yes"
lftp uname@server:~>debug 99999999
ls
    FileCopy(0x15c4e80) enters state INITIAL
FileCopy(0x15c4e80) enters state DO_COPY
---- dns cache hit
---- Connecting to server port 990
GNUTLS: HSK[0x19c5d40]: Keeping ciphersuite: DHE_RSA_AES_128_CBC_SHA1
GNUTLS: HSK[0x19c5d40]: Keeping ciphersuite: DHE_RSA_CAMELLIA_128_CBC_SHA1
GNUTLS: HSK[0x19c5d40]: Keeping ciphersuite: DHE_RSA_AES_256_CBC_SHA1
GNUTLS: HSK[0x19c5d40]: Keeping ciphersuite: DHE_RSA_CAMELLIA_256_CBC_SHA1
GNUTLS: HSK[0x19c5d40]: Keeping ciphersuite: DHE_RSA_3DES_EDE_CBC_SHA1
GNUTLS: HSK[0x19c5d40]: Keeping ciphersuite: DHE_DSS_AES_128_CBC_SHA1
GNUTLS: HSK[0x19c5d40]: Keeping ciphersuite: DHE_DSS_CAMELLIA_128_CBC_SHA1
GNUTLS: HSK[0x19c5d40]: Keeping ciphersuite: DHE_DSS_AES_256_CBC_SHA1
GNUTLS: HSK[0x19c5d40]: Keeping ciphersuite: DHE_DSS_CAMELLIA_256_CBC_SHA1
GNUTLS: HSK[0x19c5d40]: Keeping ciphersuite: DHE_DSS_3DES_EDE_CBC_SHA1
GNUTLS: HSK[0x19c5d40]: Keeping ciphersuite: DHE_DSS_ARCFOUR_SHA1
GNUTLS: HSK[0x19c5d40]: Removing ciphersuite: DHE_PSK_SHA_AES_128_CBC_SHA1
GNUTLS: HSK[0x19c5d40]: Removing ciphersuite: DHE_PSK_SHA_AES_256_CBC_SHA1
GNUTLS: HSK[0x19c5d40]: Removing ciphersuite: DHE_PSK_SHA_3DES_EDE_CBC_SHA1
GNUTLS: HSK[0x19c5d40]: Removing ciphersuite: DHE_PSK_SHA_ARCFOUR_SHA1
GNUTLS: HSK[0x19c5d40]: Removing ciphersuite: SRP_SHA_RSA_AES_128_CBC_SHA1
GNUTLS: HSK[0x19c5d40]: Removing ciphersuite: SRP_SHA_RSA_AES_256_CBC_SHA1
GNUTLS: HSK[0x19c5d40]: Removing ciphersuite: SRP_SHA_RSA_3DES_EDE_CBC_SHA1
GNUTLS: HSK[0x19c5d40]: Removing ciphersuite: SRP_SHA_DSS_AES_128_CBC_SHA1
GNUTLS: HSK[0x19c5d40]: Removing ciphersuite: SRP_SHA_DSS_AES_256_CBC_SHA1
GNUTLS: HSK[0x19c5d40]: Removing ciphersuite: SRP_SHA_DSS_3DES_EDE_CBC_SHA1
GNUTLS: HSK[0x19c5d40]: Keeping ciphersuite: RSA_AES_128_CBC_SHA1
GNUTLS: HSK[0x19c5d40]: Keeping ciphersuite: RSA_CAMELLIA_128_CBC_SHA1
GNUTLS: HSK[0x19c5d40]: Keeping ciphersuite: RSA_AES_256_CBC_SHA1
GNUTLS: HSK[0x19c5d40]: Keeping ciphersuite: RSA_CAMELLIA_256_CBC_SHA1
GNUTLS: HSK[0x19c5d40]: Keeping ciphersuite: RSA_3DES_EDE_CBC_SHA1
GNUTLS: HSK[0x19c5d40]: Keeping ciphersuite: RSA_ARCFOUR_SHA1
GNUTLS: HSK[0x19c5d40]: Keeping ciphersuite: RSA_ARCFOUR_MD5
GNUTLS: HSK[0x19c5d40]: Removing ciphersuite: PSK_SHA_AES_128_CBC_SHA1
GNUTLS: HSK[0x19c5d40]: Removing ciphersuite: PSK_SHA_AES_256_CBC_SHA1
GNUTLS: HSK[0x19c5d40]: Removing ciphersuite: PSK_SHA_3DES_EDE_CBC_SHA1
GNUTLS: HSK[0x19c5d40]: Removing ciphersuite: PSK_SHA_ARCFOUR_SHA1
GNUTLS: HSK[0x19c5d40]: Removing ciphersuite: SRP_SHA_AES_128_CBC_SHA1
GNUTLS: HSK[0x19c5d40]: Removing ciphersuite: SRP_SHA_AES_256_CBC_SHA1
GNUTLS: HSK[0x19c5d40]: Removing ciphersuite: SRP_SHA_3DES_EDE_CBC_SHA1
GNUTLS: EXT[0x19c5d40]: Sending extension CERT_TYPE
GNUTLS: EXT[0x19c5d40]: Sending extension SAFE_RENEGOTIATION
GNUTLS: HSK[0x19c5d40]: CLIENT HELLO was sent [93 bytes]
GNUTLS: REC[0x19c5d40]: Sending Packet[0] Handshake(22) with length: 93
GNUTLS: REC[0x19c5d40]: Sent Packet[1] Handshake(22) with length: 98
GNUTLS: ASSERT: gnutls_buffers.c:599
GNUTLS: XXX[]: ret: 0 Success.
GNUTLS: XXX2[]: ret: 0 Success.
GNUTLS: ASSERT: gnutls_record.c:921
GNUTLS: ASSERT: gnutls_buffers.c:1032
GNUTLS: ASSERT: gnutls_handshake.c:2700
**** gnutls_handshake: A TLS packet with unexpected length was received.
---- Closing control socket
ls: Fatal error: gnutls_handshake: A TLS packet with unexpected length was 
received.

1 Answer 1

2

Most probably you have set up ftp server so that the connection is plain text.

try connecting with ftp:// like this:

$ lftp
lftp :~> open -u uname ftp://server
lftp uname@server:~> set ftp:ssl-force yes
lftp uname@server:~> ls

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.