Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I noticed that the svn cli fails to validate https certificates and always ask for manual validation using the certificate fingerprint:

mbp:~ user$ svn co https://svn.mysite.com/svn/testrepo
Error validating server certificate for 'https://svn.mysite.com:443':
 - The certificate is not issued by a trusted authority. Use the
   fingerprint to validate the certificate manually!
Certificate information:
 - Hostname: svn.mysite.com
 - Valid: from Fri, 21 Jun 2013 00:00:00 GMT until Mon, 20 Jun 2016 23:59:59 GMT
 - Issuer: ANISSUER, DE
 - Fingerprint: 37:7d:6a:a7:e9:4c:30:57:fe:45:32:ab:bb:71:6c:79:08:4d:72:0d

All the following clients were able to validate the certificate of my own svn server as well as that of an sf.net server:

  • svn cli on Linux
  • TortoiseSVN on Windows
  • Safari/Firefox/Chrome on OSX

The two svn cli versions which I tried on OSX (Mountain Lion) and failed to validate the certificates are:

  • /usr/bin/svn: 1.6.18 (r1303927) - Mountain Lion/Xcode
  • /opt/homebrew/bin/svn: 1.7.9 (r1462340) - Compiled using homebrew

Is there any way around this problem?

share|improve this question
    
My guess is that the cause of the problem is the svn cli not being able to pick-up the root certificates trusted by the operating system. These are stored in /etc/ssl/certs in Debian, but I have no idea of their whereabouts in OSX. –  m000 Jun 21 '13 at 14:35

1 Answer 1

up vote 2 down vote accepted

A friend (who was too lazy to write the answer here) hinted me that the root certificates in Mac OSX are stored in the keychain and suggested two different ways around the problem.

In order to make openssl library (used by svn) to locate them, you need to manually export them and store them in /System/Library/OpenSSL/cert.pm. The process is described step-by-step in the following blog post: http://jw35.blogspot.gr/2011/02/root-certificates-for-macos-openssl.html

If you are using homebrew, an alternative solution is to install curl-ca-bundle package and point openssl to the location of the certificates with the use of an environment variable.

brew install curl-ca-bundle
echo "export SSL_CERT_FILE=$(brew --prefix)/opt/curl-ca-bundle/share/ca-bundle.crt" >> ~/.bashrc
share|improve this answer
1  
This worked for me, but you have to not only drop the PEM file into /System/Library/OpenSSL/cert.pm but you also need to create a file called [hash].0 that contains the same data (or, better yet, create a symlink). The [hash] is the hash of the certificate that you can get by running openssl x509 -hash -noout -in /System/Library/OpenSSL/cert.pem. This should give you an 8-character code that you can use for your symlinks's filename (e.g. 238dba32.0, where the .0 is appended to the hash to create the final filename). –  Christopher Schultz Oct 13 at 15:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.