One of the projects I'm working on has a requirement to send a document over a secure FTP connection.  The .NET framework has a built-in class to handle FTP (FTPWebRequest) so that was a good starting point.

The documentation for FTPWebRequest does not provide a great deal of detail on securing the communications between the client and the server.  There is simply a boolean property named EnableSSL to turn the encryption on or off.  Sounded pretty simple, so here's what I came up with for my upload method:

public bool UploadFile(Uri serverUri, string userName, string password, string fileName)
{
    // the serverUri should start with the ftp:// scheme.
    if (serverUri.Scheme != Uri.UriSchemeFtp)
        return false;

    try
    {
        // get the object used to communicate with the server.
        FtpWebRequest request = (FtpWebRequest)WebRequest.Create(serverUri);
        request.EnableSsl = true;
        request.Credentials = new NetworkCredential(userName, password);
        request.Method = WebRequestMethods.Ftp.UploadFile;

        // read file into byte array
        StreamReader sourceStream = new StreamReader(fileName);
        byte[] fileContents = Encoding.UTF8.GetBytes(sourceStream.ReadToEnd());
        sourceStream.Close();
        request.ContentLength = fileContents.Length;

        // send bytes to server
        Stream requestStream = request.GetRequestStream();
        requestStream.Write(fileContents, 0, fileContents.Length);
        requestStream.Close();

        FtpWebResponse response = (FtpWebResponse)request.GetResponse();
        Console.WriteLine("Response status: {0}", response.StatusDescription);
    }
    catch (Exception exc)
    {
        throw exc;
    }

    return true;
}

When I ran my app with that method, things didn't work quite like I wanted them to.  Here's the error I ended up with: "System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure."

The problem is there is no validation procedure.  None of the MSDN articles I read said anything about certificate validation.  So after much googling, I finally found the missing piece of code in a forum post.  So I added a validation procedure and assigned it as the ServicePointManager.ServerCertificateValidationCallback.

public Program()
{
    ServicePointManager.ServerCertificateValidationCallback = AcceptAllCertificatePolicy;
}

public bool AcceptAllCertificatePolicy(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
{
    return true;
}

With that, my secure FTP was a success!  Of course, in real-world applications you will want to do some actual validation of the server certificate, but I'll leave that as an exercise for the reader.