NOTE: for Control-M for Advanced File Transfer version 8.2 or Control-M Managed File Transfer 9, refer to article: 000358647

These are the known causes of this error message:

1) Most common: the CA certificate that signed/issued the FTP Server's SSL certificate, is not in AFT's Trused CA store.
2) The FTP Server's SSL Certificate expired
3) Firewall blocking the 'control socket' port.
4) FTP Server running in 'Active' mode.
5) Changing the "Security Level" to a value that is incompatibile with the FTP server.
 

For the problems listed above respectively, to resolve:

1) Import the CA certificate into the AFT key database by running:
  cd ~/ctm_agent/ctm/cm/AFT/data/SSL/cert
  ..\bin\sslcmd.exe -k aftkey.kdb
  (The default password for the CM for AFT keystore is: "cmforaft")
  Use option "2. Add CA" to add the certificate.
  
  This procedure is covered in the 5-minute video below.
  
2) Have the FTP server's administrator obtain a new SSL certificate and install it.

3) Create a route through the firewall for the blocked 'control socket' port.

4) Switch the CM for AFT Account to use passive (PASV) data transfer mode.

5) the "Security Level" which can be set in the AFT connection profile, can be set to:
  2 - No Authentication
  3 - Server Only Authentication
  4 - Client and Server Authentication
The common (and recommended minimum) setting for this would be 3. 


 

The following video shows how to idenitfy the issue, identify the certificate the FTP Server is using, and how to import the CA certificate.

The command used in the video to display the certificate (and other SSL details) the ftp server is using was:

openssl s_client -connect ftp-ssl-lab:8027 -showcerts -starttls ftp

where  ftp-ssl-lab  is the hostname and  8027  the port of the ftp server.