Making SVN trust a new root CA certificate
If you’re using Subversion to connect to an HTTPS repository that’s signed by a non-standard root certificate — such as a CACert.org certificate, for example — here’s how to do it on Linux or OS X. (Windows users: sorry, you’re out of luck. I haven’t developed on Windows since 1999, and I don’t ever want to go back. So the only way this post will ever be updated with Windows instructions is if someone else figures out how to do it and leaves a comment.)
- First, download the certificate you’re interested in, e.g. “wget http://www.cacert.org/certs/class1.crt”. I suggest storing it in /etc/ssl/certs with an appropriate name, such as “cacert-root-ca.crt”. You’ll need to have root privileges (use “sudo”) to get write access to the /etc/ssl/certs directory.
- Run “openssl md5 /etc/ssl/certs/cacert-root-ca.crt” and/or “openssl sha1 /etc/ssl/certs/cacert-root-ca.crt” and compare the results against the certificate fingerprint given on the website. The website you’re downloading this certificate from does give you its MD5 and/or SHA1 fingerprints, right? (If not, what the heck are you doing trusting a certificate you haven’t verified?!?)
- Run “openssl x509 -text -in /etc/ssl/certs/cacert-root-ca.crt” to verify that the certificate’s data (company name and so on) looks correct.
- If the above fails, add “-inform der” to the command above: maybe you accidentally downloaded the DER-encoded certificate instead of the PEM-encoded certificate.
- If you have the DER version, you’ll need to convert it to PEM. Run “sudo openssl x509 -inform der -outform pem -in /etc/ssl/certs/cacert-root-ca.crt -out /etc/ssl/certs/cacert-root-ca.pem”. Note the “sudo” in front of that command: you’re writing to the /etc/ssl/certs directory, so you need to be root.
- Now that you’ve got a certificate in PEM format and verified it, it’s time to edit your “~/.subversion/servers” file. In the “[globals]” section, add the line “ssl-authority-files = /etc/ssl/certs/cacert-root-ca.crt”. The “ssl-authority-files” option is a colon-delimited list, so if you already have something there and are adding the second certificate to it, use a colon to separate the two paths. If you’re adding a third certificate to the list, then you should already see the colon and be able to figure it out. :-)
I mostly figured this out from the “SSL Certificate Management” section of the Subversion book. Which I highly recommend reading, BTW.
I hope this helps someone else spend a little less time on Google figuring out how to trust a new root CA.
Hi there,
CaCert.org no longer has a crt file available, they have a cer file. Can I perform this same process with the .cer file?
Thanks
This thread from the comp.security.misc newsgroup says that .crt is the ASCII-encoded form of .cer — so I think the instructions would be pretty much unchanged for a .cer file. I see no options to the “openssl x509″ command that would tell it to expect a text-encoded and/or binary file, so I’m guessing it works with both.
Let me know if you try it out and something doesn’t work.
On Windows, the SSL certificates are stored in the following directory:
%USERPROFILE%\Application Data\Subversion\auth\svn.ssl.server
When you accept the certificate on one machine, a file is created a file in this folder. That file contains the necessary key. Copy that file to the corresponding directories for other profiles (and on other systems), and Subversion and TortoiseSVN will already trust the certificate.
A more elegant approach than what I wrote above is to adapt the original article.
First, you can get a DER-encoded version of the certificate from Internet Explorer. Just visit the repository in Internet Explorer (https://server/svn) and double-click on the lock icon. Click on the Details tab and then click the Copy to File button. Choose the first option, which should be to use the DER encoded binary X.509 format.
Once you have exported this file, you can start at the second-to-last bullet in the original instructions above. You’ll need the openssl executable, but that’s not hard to find, and is probably already installed on the server where you’re running Apache with Subversion.
On Windows, the “servers” file mentioned in the last bullet is located at %ALLUSERSPROFILE%\Application Data\Subversion if you want it to work for all users on the system. (If you only want the certificate to be installed for a particular user, you can modify the “servers” file at a parallel location in that user’s profile.)
I found that using quotes in the path for my ssl-authority-files did not work, so you may want to omit them.
Hmm, seems like TSVN 1.5 uses the Windows Trusted Servers. At least it accepted my self-signed cert, which is added to WinXP as trusted certification authority.
[...] This is in response to Making SVN trust a new root CA certificate. I wanted to write this there, but I can’t send comments due to a site error. [...]
Per the pingback above, this info is also available on my site, but I’ve copied it here at Robin’s request.
[quote from james.revillini.com]
This is in response to Making SVN trust a new root CA certificate. I wanted to write this there, but I can’t send comments due to a site error.
@GEEK: Thanks for starting this discussion. The previous comment is the one that helped me get my post-commit hook working with VisualSVN Server on an XP box. I was writing a hook to update my web directory from the SVN repo on every commit.
@Other contributors: Thanks for adding your comments which lead me to the right solution to properly make my server trust istself!
Just to consolidate the steps:
1. Hit the repo in IE at whatever its address is; e.g. https://server:8443/path/to/svn/
2. It will tell you the cert is untrusted. Click view certificates.
3. click Install certificate…
4. hit Next
5. select Place all certificates in the following store
6. click Browse…
7. select Trusted Root Certificate Authorities
8. hit OK
9. hit Next
10. hit Finish
11. hit Yes, OK, OK, YES!
12. Start>Run>services.msc
13. restart VisualSVN server service
Now your hooks on that machine should not have any issue updating from itself.
[/quote]
Thanks for the article!
With respect to verifying the fingerprint of the certificate, I believe your method isn’t quite right. That is, “openssl sha1 foo.crt” will return the hash of the contents of the file, whereas “openssl x509 -noout -in foo.crt -fingerprint” will return the fingerprint of the certificate contained in the file.
I tried this; it doesn’t work for me.
In my case, I have created my own root certificate (I am serving as my own CA). Then, I created a server certificate signed by the root CA certificate. I imported the root CA certificate into Firefox on another client, and it all works beautifully.
But when I tell SVN, via the .subversion/servers file, to trust my root CA certificate as a certificate authority, it still says my server’s certificate is not issued by a trusted authority!
Any clues as to what is going on?
Hello Robin,
I noticed that you store the converted certificate as
/etc/ssl/certs/cacert-root-ca.pemwhile you refer to it asssl-authority-files = /etc/ssl/certs/cacert-root-ca.crtin ~/.subversion/servers.Is this intentional or an omission?
With kind Regards,
Kasper van den Berg
Hi There, I like your writing style and this article is of a very good quality to me. Thank you :)
It seems things are going well and looking good. I am sure this will go well. I am sure it will be a good one.
Additional and additional variations like hip and cozy jackets, vests, sweaters in there. ugg classic boots outlet sale is widespread to sit back and watch sheepskin rugs and pillow in ideal here. it is perfect to ordinarily find out the on the internet merchandising outlet and often mind much more than in the direction of the stores to allow you turn out for getting delicate with Ugg outlet store
, because UGG products are coming new options on the normal basis.
An Australian Brian Smith introduced ugg boots outlet using the surfers in California who appear throughout that these shoes are extremely at ease and sturdy, so UGG shoes experienced been founded. For all gals, the brand name of ugg classic boots outlet could certainly to purchase and consider. Then ugg boots uk
outlet sale made by the manufacturers a more youthful brand name. There have distinctive sorts of boots, shoes and footwear, beautiful handbags, outfits and add-ons will be also in there. You can not just purchase even although in the market, but at the same time get them concerning the web.
Buying NFL jerseys Authentic means that you are selling the real deal and your asking price is directly affected while your buying price may not be so much. Getting the NFL jerseys Cheap product in bulk may be a question of availability.
So great blog,I like the abercrombie and fitch outlet very much,weclome to my blog abercrombie & fitch outlet to have a look,you will gain a lot form our online store.
Getting Cheap NFL jerseys is relatively easy when you get them directly from the Wholesale NFL Jerseys, as each intermediary adds on their own NFL jerseys Cheap. Another key to being sure that you are able to offer the best price to your customers is to buy NFL jerseys Wholesale. Bulk buying guarantees you the best price and when you are able to offer the best possible selling price you can attract and retain more customers.
Thank you for shairing with us.Wear the nike air max shoes to enjoy sports will be your best choose.The Nike Air Max 2012 Mens shoes are the newest style shoes in this year,never miss it.
Thanks for your infor
1000s of dvd box sets discount!free shipping!!!
more for you at http://www.dvdboxroom.com
tv shows online cheap
I precisely had to say thanks yet again. I’m not certain the things that I would’ve created in the absence of the type of strategies documented by you concerning such Christian Louboutin Outlet a subject matter. It was before an absolute intimidating problem in my opinion, however , discovering a professional avenue you handled the issue took me to cry over fulfillment. I’m grateful for the information and thus have high hopes you really know what an amazing job that you are Christian Louboutin Pumps providing instructing the others all through your web page. I’m certain you have never got to know any of us.
Just with some minor changes in the style sheet, you can get a totally different look n feel for .
The charitable store cheap uggs brings in roughly $1.3 million ugg outlet annually, Haddigan said chanel bags.
From all the remarks in your articles, it appears such as this is often a very popular website.
http://www.hats-world.com
http://www.wholesale-cheap-newerahats.com
Howdy! Very good subject matter, your internet site fails to display screen on FF4 toy with. Does indeed any equipment prohibit the IP address? Appreciate it.
Been reading this blog for awhile but i have been lazy to drop a comment and say thanks.
I certainly enjoyed the way you explore your experience and knowledge of the subject! Keep up on it. Thanks for sharing the infoYou made fantastic nice points here.
If you find yourself caught up in the recent boot craze, but think that these trendy boots are way out of touch with your wallet, there is something that you should know. Ugg boots outlet, those oh-so-soft multi-hued boots made from pure Australian sheep skin are available at a discount, if you know where to look. The best place to begin checking for discount ugg boots is on the Internet. The Internet is a wonderful invention. With a good search engine and a few clicks of a button, you can locate just about anything on the Internet, even long-lost distant relatives you had hoped you would never see again. Just begin your search for discount ugg boots clearance by typing an appropriate phrase into the search area. Faster than you can blink an eye, your computer screen will fill with pages upon pages of links you can click to start your search for your very own pair of these trendy boots. If you are looking for discount ugg Australia uk sale boots have a look at the great deals here.
The most obvious place to begin your search for discount ugg boots, even without using a search engine, is to visit your favorite web auction site. There you can search for boots, or more specifically, ugg uk sale boots, or even more specifically, three-quarter length, tan ugg Australia online boots cheapin size seven. Press a button, find a pair that matches your criteria and start naming your price. Before you know it, you will have at your doorstep your very own pair of size seven, tan, three-quarter length ugg uk boots. See that was not so hard!
Also available on the Internet are different types of shopping mall clubs which you can join by paying the stated membership fee. These types of clubs offer members the ability to purchase various items including clothing, home accessories and other consumables that are available through the particular virtual shopping mall program at a discount. The product lines that these types of virtual shopping malls carry typically include the types of items that one would expect to find in a normal shopping mall environment. So, search around for a shopping mall program which offers discount Ugg outlet store, join the program, and shop around until you find the perfect pair. Who knows, you may just get hooked on the virtual shopping mall experience. Most credit cards are accepted!
Every other guy is seen wearing cheap new era hats with their outfits everywhere they go. http://www.cheapsnapbackcaps.org They have turned into a sort of must have headgear that every person must own. Even celebrities and most rapists in the music industries can be seen sporting wholesale new era hats. these retro looking snapbacks tie in extremely well with people’s existing wardrobes without having to force them to rethink outfits. IndyCar crashBut like any great fashion piece, they make the outfit look unique and contemporary at the same time. And good luck! Please make sure to check my other articles regarding specific details on each of the above points
uggs outlet online
many people enjoy like to buy cheap discount wholesale clothing shop. the cheap designer clothes looks very funky stylish and gives a protection live. It is the one of my favorite clothing stores online. It is very cheap and good quality with buyer.
There is a popular and fashionable element, our goal is to be popular and fashionable vane, offer the best products and service, the most preferential price.
I have been previously looking at your site content with my daytime bust, plus I ought to tell you an entire write-up has become extremely helpful as well as well crafted. I assumed I would personally make you aware that I really enjoy seeing your blog won’t exhibit properly when it comes to Traveler ten. If only Microsoft windows would most likely end modifying your software package. I throw a issue available for you. Does one thought process investing web site retract inbound links? That are awesome!
What I have learned is that there are several techniques for finding cheap jerseys. First, you can search for clearance goods at stones and mortar merchants or online retailers. The clearance racks are usually filled with all the names and amounts of players which have been no longer active while using the team. This consists of guys which may have changed teams because of trades or perhaps free bureau,Cheap NBA Jerseys or that contain retired. So prefer a Shawne Merriman jacket, you will pay full cost for their new Zoysia Bills gear or pay in regards to quarter of the price on an nfl jerseys Cheap. I personally wouldn’t thoughts wearing Cheap NBA Jerseys, but our sons won’t hear of computer.
A 5-0 victory, as well as moncler outlet direct competitors of non flat or negative, making pleasant than Chelsea Manchester City rose 1 point standings of the third, fifth and also with the points difference between the Spurs pull large as 6 points. The stability of the league rankings again and again he let the recent bad luck with the breathing space Mancini, but also makes the results of the battle for Champions League tickets has become increasingly Moncler down jackets clear, with Mancini’s words after the game that is “a situation good. ”
When Mourinho proud hopeless admit chasing league titles, while Carlo Ancelotti has avoided the topic of the league instead to target the Moncler online shop Champions League quarter-final civil war in England, shows Chelsea has focus on the war in Europe the game. Similar situation with Chelsea will win all their hopes on Manchester City in the FA Cup will also check out Manchester United’s “Triple Crown dream.” Mancini 5-0 victory over Sunderland after the team confidence soared in the post-match interview, Italian Marshal vowed: “This season our goal is to get a cheap moncler jackets ticket into the Champions League, as well as in Manchester United squeezed into the FA Cup final on exterminate, and then they had a smooth cup. “In short, Mancini not only to compete for a Champions League next season’s tickets, but also to the team at the end of the season since 1976. won the League Cup after 35 years without the embarrassment of the highest record. Looking back again compete moncler vests for the Champions League tickets, Manchester City’s main rival, leaving only the current Chelsea, Tottenham, perhaps Liverpool. However, while all two-lane operations, but Manchester City and Chelsea team had depth two dollar thick enough, but Manchester City to participate in the FA Cup in terms of pressure or intensity of the race, Chelsea must be easy to get and more. Taking into account the impact of Chelsea’s Champions League is almost the most drastic, their level of commitment for the league would be difficult Moncler kids , compared with Manchester City. In addition, only in the league Manchester City and Tottenham Liverpool is still the strength of two strong opponents, Blackburn, West Ham, Everton, Stoke City and Bolton or the strength of incompetence, or seeding, As Mancini stated: “The next race finally makes a break up.”
While Tottenham and Liverpool, into the next season’s Champions League hopes have been very slim. Tottenham and Manchester City that Moncler Men Jackets lie between the points 6 points difference, though not seemingly not so far away, and the Tottenham also have a game, but given the Spurs to the Champions League game against a strong Real Madrid, coach is also at the expense of league results in a difference in the Champions League, which makes them difficult to catch up with Manchester City’s mission. In addition, they in the remaining eight league opponents in half of the top six teams – Chelsea, Arsenal, Liverpool, Manchester City, Manchester City want to Moncler Women Jackets reproduce the beat into the Champions League last season’s brilliant, really too difficult large. Even if the Spurs can be tied in points on Manchester City, Blue Moon Legion of up to 23 goal difference advantage that Spurs (7 goal difference) far behind. The points behind 11 points ahead of Liverpool is almost declared to Champions League game.
An experienced reporter qualifying football Tory Burch outlet a decade ago, said: “Maybe Gao Hongbo already have their minds lineup, but to consider the interests of the club to balance the various international, playing time, so it constantly evolutions.” While the former striker Hao Haidong is this not recognized: “As a coach, you have to examine who should be very clear, warm-up should be investigated in the first three games off the bench, before the start of the contest focused on Tory Burch Sale running the final two games lineup, and we not the Spanish national team, there can be a considerable level of 50 individuals, who can not become the main force. ”
Gao Hongbo this year’s Asian Cup, “training” led to the outside of many questions, the same face of a decade ago Milutinovic lot of pressure. Ten years ago the national team, Sun Jihai, Fan Zhiyi, Hao Haidong, Yang Chen and other big tory burch outlet online gathering, to manage such a team is not simple, Milutinovic is the team with a smile to resolve the contradictions and pressures. Then experienced another qualifying football reporter said, when the coaching is not just Milutinovic, a player every coach in the ideological work to help the players for emotional regulation, so that a Tory Burch shoes more harmonious atmosphere in the team, but The current national team, in this respect is not enough.
Participated in the Asian Cup defender Li Xuepeng, said: “to the contest will certainly tight, but certainly the ability to adjust tory burch on sale different emotions.” Milutinovic has served as an assistant coach Jin Zhiyang that Milutinovic’s happy not just talk football, he was in possession the lifeblood of the development of Chinese football, football Tory Burch Shoes Sale should be happy with the mentality to do, lose, it happy. From the first World Cup in less than four months time, copy Milutinovic its former glory? Gao Hongbo, there are many things to do.
new era hats
new era hats
The medieval Cathedral in Salisbury,UK will host a five-day floral show with internationally-inspired designers.And while the newly divorced Wilde came to the premiere solo, her also just-divorced co-star Reynolds had a special date to the show. Sandra Bullock,If you are averse to the real thing, Emporio Armani has a fun, knitted knee-length furry effect cardi/coat in a deep blue/black (£569), which would look as good over jeans as it would over a day dress or a pair of black pants, towering heels and a silk shirt. his friend and fellow actor in the 2009 hit comedy “The Proposal,” arrived just in time to surprise him on the red carpet,Moncler and add fuel to the rumors that the pair has recently been stepping out together as more than friends. Arrangements will be inspired by quotations from the King James Bible, honouring its 400th anniversary. Interpretative designs created by the Cathedral’s own team of flower arrangers explore the themes of splendour, power, glory and majesty, according to the Cathedral’s newsletter. Some 18,000 people attended the last demonstrantion in 2008.
your post are very interesting it is also helpful for me thanks for sharing look forward more posts
Wholesale Air Max Shoes
men Ralph Lauren t shirts
Thank u for your sharing.Your blog has a unique feature that can make the people who reads become happy.After reading your blog,I feel happy.
caiyifang/comment201111
Shop the golf clubs at a lower price ,No sales tax,Alway Free delivery.
Wonderful blog! I definitely love how it’s easy on my eyes and also the data are well written. I am wondering how I might be notified whenever a new post has been made. I have subscribed to your rss feed which need to do the trick! Have a nice day!
In the promotional products industry discount ugg boots,cheap uggs outlet, prepress services like vector art and embroidery digitizing are as important (if not more) as promotional products,cheap burberry scarf, themselves. After all ugg boots clearance,chanel boots on sale uggs clearance, the reason companies choose to add promotional products to their marketing mix is to ensure that their brand names and logos are viewed repeatedly.Company logos from computer images must be converted into vector art in order to get clear cheap ugg boots,
Great information you got here. I’ve been reading about this topic for one week now for my papers in school and thank God I found it here in your blog. I had a great time reading this.
The latest achieve miraculous Fendi repeatedly (Fendi) by 2010,
Wholesale Air Max Shoes qiu dong series welcomed the downy tone: teach enchanted orange,
Louis Vuittion Handbag green, navy blue water duck and bone brown, pieced wine red, blue, gray and black, grey extracted from U.S. distinguished reality inspiration send painter and etchers Edward Hopper works. Skirt length also mini skirts,Gucci Clothing medium length and dresses up, because he didn’t said which is the most fashionable.
Buy Moncler Jackets‘Thank you. Well, good bye, my dear boy. Cheap Moncler Jackets I suppose that after that reprehensible affair last night you will have to think of some other profession. Well, you may congratulate yourself that you discovered your unfitness for the priesthood before it was too late.Discount Moncler Coats Sale If a parson does a thing of that sort, you know, all the world knows. And so many do, alas! What do you propose doing?”I don’t really know yet. Baseball Hats Caps ”There is always commerce, of course.
Nice article , thank you for sharing your article. I genuinely enjoyed it. I place a url to my website to right here so other group men and girls can research it.caiyifang/comment201111
I can’t agree more this is a mighty thoughtfully written story, thank you for writing it.caiyifang/comment201111
I feel strongly about information and love learning more on this. If possible, as you gain expertise, It is extremely helpful for me. would you mind updating your blog with more information?
Fine and well written article. I like it a much. I hope that you can still provide in the future articles like that. I will subscribe in case you do.
Wear the Tory Burch Heels are so comfortable and beautiful.When you wear the tory burch shoes and take the Tory Burch Wallets to go outside,you are the most fashion women.