Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am running RedHat Enterprise Linux 6 and have a subversion server installed (with Apache). I have just configured Apache to run HTTPS with an SSL Certificate from Geotrust. The Apache part of things is running fine (I can access my site via HTTPS without warnings or issues).

However, when I run an svn co https://myserver.com/svn/proj_name, I get the following error:

Error validating server certificate for 'https://myserver.com:443':
 - The certificate is not issued by a trusted authority.  Use the
   fingerprint to validate the certificate manually! 
Certificate information:
 - Hostname: myserver.com
 - Valid: from Sun, 23 Oct 2011 16:15:13 GMT until Thu, 25 Oct 2012 05:38:36 GMT
 - Issuer: GeoTrust, Inc., US
 - Fingerprint: (some fingerprint)
(R)eject, accept (t)emporarily or accept (p)ermanently?

Also, I have in my subversion "servers" configuration file:

[global]
ssl-authority-files=/usr/share/certs/GeoTrust_Primary_CA.pem;
ssl-trust-default-ca = true

But when I attempt to access subversion, I find this in the error log:

svn: Invalid config: unable to load certificate file '/usr/share/certs/GeoTrust_Primary_CA.pem'

Everyone has read access to this file - and I downloaded it straight from GeoTrust's website. Is there something I'm missing?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

Most likely, something is wrong with the certificate file. You can check it with:

openssl x509 -text < /usr/share/certs/GeoTrust_Primary_CA.pem

The output should include:

    Version: 3 (0x2)
    Serial Number:
        18:ac:b5:6a:fd:69:b6:15:3a:63:6c:af:da:fa:c4:a1
    Signature Algorithm: sha1WithRSAEncryption
    Issuer: C=US, O=GeoTrust Inc., CN=GeoTrust Primary Certification Authority
    Validity
        Not Before: Nov 27 00:00:00 2006 GMT
        Not After : Jul 16 23:59:59 2036 GMT
    Subject: C=US, O=GeoTrust Inc., CN=GeoTrust Primary Certification Authority
    Subject Public Key Info:

or

md5sum /usr/share/certs/GeoTrust_Primary_CA.pem 

The output should be: 55a9909182b959dcbb00c550725bcdf2 GeoTrust_Primary_CA.pem

share|improve this answer
    
I totally skimmed past the certificate load error, apparently! Good catch. I'll leave my answer up in case it happens to be applicable after the certificate issue is fixed.. –  Shane Madden Oct 26 '11 at 21:32
1  
When I ran the above command (openssl x509...), I received a similar error. I re-downloaded the certificated (using wget) and this particular error went away (and the command resulted in the expected output). Thanks! –  nuclearpenguin Oct 27 '11 at 12:09
    
I would also like to point out that although this fixed the first problem, I have ran into another problem (posted as a different question since it's a different issue) here: serverfault.com/questions/325314/… –  nuclearpenguin Oct 27 '11 at 13:03

A couple of things to check:

  • Make sure that trusted root is really and truly the root of the trust chain for your certificate.

Just fire up your SVN site in a browser and check out the certificate path, leading back to the root - make sure that root's thumbprint matches the file that you have.

And export the certificates to x509, in preparation for step two:

  • Make Apache kick out the full path of certificates that lead all the way back to the root.

The SVN client isn't able to infer the intermediates if Apache isn't presenting them.

You'll want an SSLCertificateChainFile directive, pointing to a file containing the x509 certificate chain (other than your own cert, which should be in the SSLCertificateFile):

-----BEGIN CERTIFICATE-----
(intermediate certificate's base64 data here)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(root certificate's base64 data here)
-----END CERTIFICATE-----

Once this is done, verify that Apache's sending the whole chain with openssl s_client -connect myserver.com:443 -showcerts.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.