SVN Trusted Certification Error [closed]

Question

Possible Duplicate:
SVN SSL Certificate Validation Error

I am running RedHat Enterprise Linux 6 and have a subversion server installed (with Apache). I have just configured Apache to run HTTPS with an SSL Certificate from Geotrust. The Apache part of things is running fine (I can access my site via HTTPS without warnings or issues).

However, when I run an svn co https://myserver.com/svn/proj_name, I get the following error:

Error validating server certificate for 'https://myserver.com:443':
 - The certificate is not issued by a trusted authority.  Use the
   fingerprint to validate the certificate manually! 
Certificate information:
 - Hostname: myserver.com
 - Valid: from Sun, 23 Oct 2011 16:15:13 GMT until Thu, 25 Oct 2012 05:38:36 GMT
 - Issuer: GeoTrust, Inc., US
 - Fingerprint: (some fingerprint)
(R)eject, accept (t)emporarily or accept (p)ermanently?

Also, I have in my subversion "servers" configuration file:

[global]
ssl-authority-files=/usr/share/certs/GeoTrust_Primary_CA.pem;
ssl-trust-default-ca = true

But when I attempt to access subversion, I find this in the error log:

svn: OPTIONS of 'https://myserver.com/svn/project_name': Server certificate verification failed: issuer is not trusted (https://myserver.com)

I know that SVN is loading the GeoTrust Primary CA file, and since my certificate is FROM GeoTrust, I can't figure out why it's still saying the server certificate verification failed. Why does it still think the issuer is not trusted?

Answer 1

A certificate labeled "primary" implies that there could be a "secondary" intermediate certificate as well. Browsers make terrible ssl verification tools because eack browser maker often imports these intermediate certificates into their keystores, which masks problems like the one you are seeing with svn.

Does GeoTrust use a four-way certificate chain with your ssl cert? If so, you are going to want to create a pem bundle for your apache config and include both intermediate certs in that bundle.

Answer 2

Well, I specifically stated on your other question that this answer may be applicable once you fixed the certificate loading issue.. but hey, I guess I'll delete it from there and re-post it here.

---

A couple of things to check:

• Make sure that trusted root is really and truly the root of the trust chain for your certificate.

Just fire up your SVN site in a browser and check out the certificate path, leading back to the root - make sure that root's thumbprint matches the file that you have.

And export the certificates to x509, in preparation for step two:

• Make Apache kick out the full path of certificates that lead all the way back to the root.

The SVN client isn't able to infer the intermediates if Apache isn't presenting them.

You'll want an SSLCertificateChainFile directive, pointing to a file containing the full x509 certificate chain (other than your own cert, which should be in the SSLCertificateFile):

-----BEGIN CERTIFICATE-----
(intermediate certificate's base64 data here)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(root certificate's base64 data here)
-----END CERTIFICATE-----

If there's more intermediates, just add them in reverse order.

Once this is done, verify that Apache's sending the whole chain with openssl s_client -connect myserver.com:443 -showcerts.