Hi,
We have a client/server application, where the server (console app on Windows) is exposing an SFTP endpoint, implemented with Rebex FileServer library, and the client is connecting to it, using Rebex SFTP library.
I am trying to validate the server I am connecting to, from the client, using a server certificate (signed by a CA, similar to a TLS certificate), instead of a public key (https://smallstep.com/blog/use-ssh-certificates/).
The reason is to avoid having to know in the client, the server key thumbprint.
The server certficate is read from WIndows cert store (including the private key) like this:
X509Certificate2 cert = store.Certificates.Find(X509FindType.FindByThumbprint, thumbprint, false);
var sftpServer = new FileServer();
sftpServer.Bind(port, FileServerProtocol.Sftp);
sftpServer.Keys.Add(new SshPrivateKey(cert.PrivateKey));
sftpServer.Settings.AllowedAuthenticationMethods = AuthenticationMethods.Password;
...
sftpServer.Start()
On the client, I am connecting like this:
var ftp = new Sftp();
ftp.Settings.SshParameters.AuthenticationMethods = SshAuthenticationMethod.Password;
...
ftp.Connect(serverName, port);
// this is where I expect to get an error only if the server cert is invalid
ftp.Login(user, password);
The root CA exists on both the server and client computer.
Now, at Connect I get no error/exception.
(I use the latest Rebex component versions, on Windows 10, .NET Framework 4.8)
I also tried to manually validate the server certificate like this:
SshPublicKey serverKey = ftp.ServerKey;
Rebex.Security.Certificates.Certificate publicServerCertificate = serverKey.GetCertificate();
var validationResult = publicServerCertificate.Validate();
if (!validationResult.Valid)
{ ... }
but serverKey.GetCertificate() returns null.
I would avoid showing a prompt to the user to accept the server key thumbprint, as I know that I use a certificate that is already signed by a public CA (the client application is always connecting to the same server app, but we try to avoid man-in-the middle attacks).