I am setting up an FTP server and I need to use my own self-signed certificates for FTPS. When I configure vsftpd to use my self-signed certificates it fails to start.

The exact same setup works without issue in Ubuntu 18.04 (both are AWS EC2 instances). I am using vsftpd version 3.0.3 in both cases.

This is how I am creating the certificates:

mkdir certificates && cd certificates
mkdir ubxtestCA && cd ubxtestCA
openssl req -new -x509 -days 365 -extensions v3_ca -keyout $CANAME.key -out $CANAME.crt &&
openssl genrsa -out $CLIENTNAME.key 1024 &&
openssl req -out $CLIENTNAME.csr -key $CLIENTNAME.key -new &&
openssl x509 -req -in $CLIENTNAME.csr -CA $CANAME.crt -CAkey $CANAME.key -CAcreateserial -out $CLIENTNAME.crt -days 365 &&
openssl genrsa  -out $SERVERNAME.key 1024 &&
openssl req -out $SERVERNAME.csr -key $SERVERNAME.key -new &&
openssl x509 -req -in $SERVERNAME.csr -CA $CANAME.crt -CAkey $CANAME.key -CAcreateserial -out $SERVERNAME.crt -days 360

My deployment process is as follows:

  • deploy AWS EC2 instance
  • sudo apt update
  • create certificates
  • sudo apt install vsftpd
  • edit /etc/vsftpd.conf to change rsa_cert_file and rsa_private_key to my new certificates
  • sudo systemctl restart vsftpd
  • sudo systemctl status vsftpd

After restarting vsftpd the status shows:

  • vsftpd.service: Main process exited, code=exited, status=2/INVALIDARGUMENT

If I copy the vsftpd snakeoil certificates into the same directory as my own certificates and point to these in the vsftpd.conf file, this also works.

If I follow the exact same process on Ubuntu 18.04 I do not get any errors and my certificates work (client is able to validate the server identity).


I discovered the problem.

For some reason VSFTPD (on Ubuntu 20.04) does not work with a certificate that uses a 1024 bit key. After changing the keys generated in my example to 2048 bits, it works.


Update 10/7/20: As suggested in the comments here are details about how I identified the source of this issue:

I compared the working snakeoil certificate included with vsftpd to my certificate. This was done with the command:

openssl x509 -in <certificate_file> -text -noout

I changed one aspect of my certificate at a time to match the snakeoil certificate until the vsftpd error went away. I tried changing the subject to only include the CN field (removing C, ST, L, O, OU, and emailAddress fields). I also changed the certificate from version 1 to version 3. Finally changing the RSA key used to 2048 bits allowed vsftpd to successfully start up.

  • Thanks for the suggestion @Nmath. I've updated my answer to explain how I figured this out. – rmcnish Oct 8 '20 at 3:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.