How do I setup ssl to use with an ftp server?

[Usalabs1]

I'm using windows xp pro and IIS 5.0 for the webserver, I'm not using the ftp server side of IIS, I use a 3rd party server called 'serv-u' with ssl support, when I choose to use ssl on certain web pages, there's no problem with https access

The problem is, when I setup ssl with the self signed certificate, (created by serv-u), then I install it into the trusted certificates section of windows, only ftp clients that support ssl, can connect.

The only way that the server can be accessed is by an ftp client that supports ssl, and not everyone uses an ftp client, I even tried typing in the server address into internet explorer e.g... ftp://usernameassword@myserver.comort or even this ftps://usernameassword@myserver.comort

The result is 'unable to connect using ssl', I even set IE for ftp passive mode, the same error, but when I use an ftp client, there's no problem, is there a way that a user can use IE (if they don't have a client), so that IE can connect to my ftp server using ssl?

Or if someone could suggest an ftp server that would allow ssl connection from IE or an ftp client.

 

[bcastner]

See if the problem does not lie with a security patch from Microsoft. A workaround is also discussed here:

http://support.microsoft.com/?kbid=834489

 

[Usalabs1]

bcastner.....The microsoft article refers to http and https calls using ssl, what I'm looking for is using ssl with ftp, I have no problem with https, the problem is with using ftp:// not

https://.

for example.... if I entered into IE

https://blahblahblah

it works, but if I use the ftps:// address then connection via ssl doesn't work.

 

[bcastner]

I do not have a reference to the changes made on the ftp side of IE to control "phising", but I am certain they were made.

IE with hotfixes will not accept a phised address that contains a username and passsword.

 

[bcastner]

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q135975

For more information, consult RFC2396, 3.2.2

http://www.faqs.org/rfcs/rfc2396.html

Incidentally, RFC2396 also states,
"Some URL schemes use the format 'user:rassword' in the userinfo field. This practice is NOT RECOMMENDED, because the passing of authentication information in clear text (such as URI) has proven to be a security risk in almost every case where it has been used."

 

[bcastner]

You might find this a good fit:

http://www.southrivertech.com/index.php?pg=./products/webdrive/index