svn ls https://... results in "The certificate has an unknown error"

[Erik Wasser]

Hello list,

I'm crossposting this from the gentoo forum
"http://forums.gentoo.org/viewtopic-t-801013.html"

Subject: svn https:// results in The certificate has an unknown error

I've got 2 boxes of gentoo here, running nearly the same software. In this
case apr-1.3.9, apr-util-1.3.9, neon-0.29.0, gnutls-2.8.4 and subversion-1.6.5
with the same use flags.

Running a simple "ls" over https:// command at work works fine:

% svn ls https://dev.int.example.net/
Error validating server certificate for 'https://dev.int.example.net:443':
 - The certificate hostname does not match.
Certificate information:
 - Hostname: *.example.net
 - Valid: from Mon, 11 Jun 2007 00:00:00 GMT until Wed, 15 Sep 2010 23:59:59
GMT
 - Issuer: Comodo CA Limited, Salford, Greater Manchester, GB
 - Fingerprint: d2:d6:76:ee:7c:b1:87:ce:28:6a:0e:eb:c5:03:87:30:cf:1d:a7:b9
(R)eject, accept (t)emporarily or accept (p)ermanently?

I can accept the certificate forever and that's fine. No more questions for
me.

Running the same command at home brings me to this:

% svn ls https://dev.int.example.net/
Error validating server certificate for 'https://dev.int.example.net:443':
 - The certificate hostname does not match.
 - The certificate has expired.
 - The certificate has an unknown error.
Certificate information:
 - Hostname: *.example.net
 - Valid: from Mon, 11 Jun 2007 00:00:00 GMT until Wed, 15 Sep 2010 23:59:59
GMT
 - Issuer: Comodo CA Limited, Salford, Greater Manchester, GB
 - Fingerprint: d2:d6:76:ee:7c:b1:87:ce:28:6a:0e:eb:c5:03:87:30:cf:1d:a7:b9
(R)eject or accept (t)emporarily?

I've got 2 more error messages here and the option "'(p)ermanently" is
missing. Why's that? Caused by what? Removing the ~/.subversion doesn't help.

I've done some testing with "strace -fF -e trace=file svn ls $URL" to figure
out what files will be used. The only filename that got something todo with
SSL was "/etc/ssl/certs/ca-certificates.crt". And that file was the same on
both servers.

What I'm missing here? How do I solve this problem? What else can I try to
narrow down the problem?

--
So long... Fuzz

------------------------------------------------------
http://subversion.tigris.org/ds/viewMessage.do?dsForumId=1065&dsMessageId=2415043

To unsubscribe from this discussion, e-mail: [users-unsubscribe@...].

[Stefan Sperling-7]

On Fri, Nov 06, 2009 at 10:33:26AM +0100, Erik Wasser wrote:

> Hello list,
>
> I'm crossposting this from the gentoo forum
> "http://forums.gentoo.org/viewtopic-t-801013.html"
>
> Subject: svn https:// results in The certificate has an unknown error
>
> I've got 2 boxes of gentoo here, running nearly the same software. In this
> case apr-1.3.9, apr-util-1.3.9, neon-0.29.0, gnutls-2.8.4 and subversion-1.6.5
> with the same use flags.

Does this also happen with neon-0.28.x?

Stefan

------------------------------------------------------
http://subversion.tigris.org/ds/viewMessage.do?dsForumId=1065&dsMessageId=2415060

To unsubscribe from this discussion, e-mail: [users-unsubscribe@...].

[Erik Wasser]

On Friday 06 November 2009 11:59:12 Stefan Sperling wrote:

> > I've got 2 boxes of gentoo here, running nearly the same software. In
> > this case apr-1.3.9, apr-util-1.3.9, neon-0.29.0, gnutls-2.8.4 and
> > subversion-1.6.5 with the same use flags.
>
> Does this also happen with neon-0.28.x?

You made my day. Downgrading to neon-0.28.6 and I can accept the certificate
permanently. Everything is now fine.

Is this a know issue? Do you have a bugtracking url for this?

Thanks for the quick and working answer. B-)

--
So long... Fuzz

------------------------------------------------------
http://subversion.tigris.org/ds/viewMessage.do?dsForumId=1065&dsMessageId=2415064

To unsubscribe from this discussion, e-mail: [users-unsubscribe@...].

[Stefan Sperling-7]

On Fri, Nov 06, 2009 at 12:28:24PM +0100, Erik Wasser wrote:

> On Friday 06 November 2009 11:59:12 Stefan Sperling wrote:
>
> > > I've got 2 boxes of gentoo here, running nearly the same software. In
> > > this case apr-1.3.9, apr-util-1.3.9, neon-0.29.0, gnutls-2.8.4 and
> > > subversion-1.6.5 with the same use flags.
> >
> > Does this also happen with neon-0.28.x?
>
> You made my day. Downgrading to neon-0.28.6 and I can accept the certificate
> permanently. Everything is now fine.
>
> Is this a know issue? Do you have a bugtracking url for this?

 
I don't know. Check with the neon developers.

> Thanks for the quick and working answer. B-)

You're welcome, I'm glad to have guessed correctly :)

Stefan

------------------------------------------------------
http://subversion.tigris.org/ds/viewMessage.do?dsForumId=1065&dsMessageId=2415072

To unsubscribe from this discussion, e-mail: [users-unsubscribe@...].