#1041283 pure-ftpd-common: pure-ftpd-wrapper does not support setting TLS certificate/key file

#1041283#5
Date:
2023-07-16 22:04:06 UTC
From:
To:
Hi –

It seems that Pure-Ftpd now has a command line option that lets the admin
configure the location of the TLS certificate/key file(s). This option,
however, is not supported by the pure-ftpd-wrapper script.

I'm enclosing a patch that adds support for the two settings mentioned
in the pure-ftpd.conf file (CertFile and CertFileAndKey). The "CertFile"
configuration file specifies a single file name, referring to a file that
contains the certificate and the corresponding private key, while the
"CertFileAndKey" configuration file specifies two file names on the same
line, separated by ":", ",", a space or a tab, giving the file containing
the certificate and that containing the key separately. (In both cases,
the certificate can actually be a bundle of certificates including any
required intermediate certificates.)

It would be great if this patch (or something else to the same effect)
could be made part of the official distribution.
--- pure-ftpd-wrapper.orig      2023-07-16 21:28:46.981044290 +0000
+++ pure-ftpd-wrapper   2023-07-16 21:36:46.454419036 +0000
@@ -65,6 +65,8 @@
                        'Bind' => ['-S %s', \&parse_string],
                        'BrokenClientsCompatibility' => ['-b'],
                        'CallUploadScript' => ['-o'],
+                       'CertFile' => ['-2 %s', \&parse_filename],
+                       'CertFileAndKey' => ['-2 %s,%s', \&parse_filename_2],
                        'ChrootEveryone' => ['-A'],
                        'CreateHomeDir' => ['-j'],
                        'CustomerProof' => ['-Z'],
@@ -240,6 +242,25 @@
        return 1;
 }

+sub parse_filename_2 {
+       my ($buf, $fmt, $val) = @_;
+
+       if ($val =~ /^(.*)[,:\s](.*)$/) {
+               unless (-f $1) {
+                       $$buf = qq{"$1": No such file};
+                       return;
+               }
+               unless (-f $2) {
+                       $$buf = qq{"$2": No such file};
+                       return;
+               }
+               $$buf = sprintf $fmt, $1, $2;
+               return 1
+       }
+
+       $$buf = qq{"$val": must be two file names separated by comma, colon, or space};
+}
+
 sub parse_ip {
        my ($buf, $fmt, $val) = @_;

#1041283#10
Date:
2026-06-10 10:28:16 UTC
From:
To:
I encourage to introduce at least "CertFile" because the related "-2"
is well documented:
more than 1 file separated by comma? What do you expect and does it
really work? I believe it just does not work.



CURRENT WORKAROUND:

Note for myself that the default cert seems saved here:
/etc/ssl/private/pure-ftpd.pem

So, if somebody like me needs to set a specific certificate, I assume I
can just create that file, without specifying any new configuration and
without improving the wrapper script.

TL;DR I recommend to introduce "CertFile", and maybe just that.