NetSuite N/sftp模块FTP_CANNOT_ESTABLISH_CONNECTION错误：RSA私钥连接服务器认证失败问题排查

Let’s walk through the most likely fixes here—since your setup works perfectly in FileZilla but throws an auth error in NetSuite, there are a few key discrepancies to check:

1. Host Key Format Mismatch #

The biggest culprit here is probably the host key format. When you use ssh-keyscan, it outputs keys in OpenSSH’s default format (e.g., ssh-rsa AAAAB3NzaC1yc2E...), but NetSuite’s SFTP client often expects a PEM-formatted host key instead. FileZilla automatically handles this conversion in the background, which is why it works there.

Try converting your host key to PEM with this bash command:

ssh-keyscan -t rsa -p ${PORT_SERVER} ${URL_SERVER} | ssh-keygen -f /dev/stdin -e -m pem

Use the full output (including the -----BEGIN RSA PUBLIC KEY----- and -----END RSA PUBLIC KEY----- headers/footers) as the hostKey value in your sftp.createConnection call.

2. Verify Private Key Upload to NetSuite #

Even though you converted the key to PEM format, double-check that you uploaded the entire key content to NetSuite’s Setup/Company/Keys section—no missing lines, no extra spaces, and definitely including the full -----BEGIN RSA PRIVATE KEY----- and -----END RSA PRIVATE KEY----- markers. Accidental trimming of these lines is a super common cause of auth failures.

Also, confirm the key has no passphrase (you used -N "" in ssh-keygen, which is correct) and that NetSuite didn’t flag it for any formatting issues during upload.

3. Check for Hidden Formatting Issues #

When copying the key to NetSuite, avoid using rich text editors (like Word) that might add hidden formatting. Use a plain text editor (Notepad, VS Code, nano) to copy the entire PEM key, then paste it directly into NetSuite’s key field. Even a single extra newline or space can break key parsing.

4. Double-Check Connection Parameters #

It’s easy to overlook a typo here—verify every parameter matches exactly what you used in FileZilla:

• username: Ensure this is the exact same username (some servers require fully qualified names like user@domain instead of just user)
• keyId: Confirm this matches the internal ID of the key you uploaded in NetSuite (you can find this by viewing the key’s details in the setup page)
• port: Make sure the port number is correct—FileZilla defaults to 22 if unspecified, but custom ports need to be explicitly set in NetSuite

5. SSH Protocol Version Compatibility #

Some servers restrict connections to specific SSH protocol versions. FileZilla defaults to SSH-2, but NetSuite’s client might be using a different version. Check NetSuite’s documentation for sftp.createConnection to see if you can force SSH-2 in your connection options.

内容的提问来源于stack exchange，提问作者Millet Antoine