You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@subversion.apache.org by Nick Wright <ni...@lsd.net.nz> on 2003/09/29 08:34:57 UTC
SSL related error
Hi, can anyone tell me how to fix this problem?
When try to access my repository over https, I get the following error:
nick@highgate: nick> svn co https://192.168.1.1/trunk/foo ./test
svn: RA layer request failed
svn: PROPFIND request failed on '/trunk/foo'
svn: PROPFIND of '/trunk/foo': SSL server did not present certificate
(https://192.168.1.1)
I get the same error connecting from inside my LAN as well as from computers
elsewhere.
I had this working fine until I upgraded to subversion 0.29 (now running
version 0.30).
I can connect to my https web server with a browser just fine too. The server
has a self-signed certificate authority key and server key.
Thanks for any help.
Nick.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: SSL related error
Posted by Joe Orton <jo...@manyfish.co.uk>.
On Wed, Oct 01, 2003 at 08:50:43PM +1200, Nick Wright wrote:
> Hi - yes I do:
>
> SSLProtocol -all +SSLv2
> SSLCipherSuite SSLv2:+HIGH:+MEDIUM:+LOW:+EXP
>
> This was from the Apache2 SSL/TLS howto page.
> I have changed the lines to this (from the same page):
>
> SSLProtocol all
> SSLCipherSuite HIGH:MEDIUM
>
> ..problem solved - thanks!
>
> Would you like me to leave the server set up with the old flags for a while?
No, thanks, I can reproduce the bug here now I've worked out what was
different about your server. The recommended default config is to use
no SSLProtocol line and this cipher suite config:
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP
for best compatiblity with web browsers.
Regards,
joe
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: SSL related error
Posted by Nick Wright <ni...@lsd.net.nz>.
Hi - yes I do:
SSLProtocol -all +SSLv2
SSLCipherSuite SSLv2:+HIGH:+MEDIUM:+LOW:+EXP
This was from the Apache2 SSL/TLS howto page.
I have changed the lines to this (from the same page):
SSLProtocol all
SSLCipherSuite HIGH:MEDIUM
..problem solved - thanks!
Would you like me to leave the server set up with the old flags for a while?
Nick.
> Have you got any SSLCipherSuite lines in your server config?
>
> This bug is being trigged because an SSLv2 connection is getting
> negotiated here rather than SSLv3/TLSv1 as one would expect from this
> combination of an OpenSSL client and server.
>
> joe
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
> For additional commands, e-mail: users-help@subversion.tigris.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: SSL related error
Posted by Joe Orton <jo...@manyfish.co.uk>.
On Tue, Sep 30, 2003 at 05:20:28PM +0100, Joe Orton wrote:
> On Wed, Oct 01, 2003 at 03:22:00AM +1200, Nick Wright wrote:
> > I suspect there is some sort of issue with the way I have Apache/SSL set up..
> > I'm fairly new to the SSL side of things especially..
> >
> > Anything to do with the "dropped support for PEM-encoded client certs, only
> > accept PKCS12 now" thing new in NEON 0.24 perhaps?
> >
> > The server runs Debian testing/unstable, Apache/2.0.47 (Debian GNU/Linux),
> > DAV/2 SVN/0.30.0, mod_ssl/2.0.47, OpenSSL/0.9.7b
> >
> >
> > If you havent done so already, the output from the openSSL client is posted
> > below.
> >
> > You can try connecting to the repository also - it's just at
> > https://highgate.net.nz/
>
> The patch below should work around this with neon 0.24.2, thanks for
> making the server available. (it would help if you could leave it
> available too so I can work out whether the test suite is woefully
> inadequate in not catching this, or just that your server config is
> strange)
Have you got any SSLCipherSuite lines in your server config?
This bug is being trigged because an SSLv2 connection is getting
negotiated here rather than SSLv3/TLSv1 as one would expect from this
combination of an OpenSSL client and server.
joe
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: SSL related error
Posted by Joe Orton <jo...@manyfish.co.uk>.
On Wed, Oct 01, 2003 at 03:22:00AM +1200, Nick Wright wrote:
> I suspect there is some sort of issue with the way I have Apache/SSL set up..
> I'm fairly new to the SSL side of things especially..
>
> Anything to do with the "dropped support for PEM-encoded client certs, only
> accept PKCS12 now" thing new in NEON 0.24 perhaps?
>
> The server runs Debian testing/unstable, Apache/2.0.47 (Debian GNU/Linux),
> DAV/2 SVN/0.30.0, mod_ssl/2.0.47, OpenSSL/0.9.7b
>
>
> If you havent done so already, the output from the openSSL client is posted
> below.
>
> You can try connecting to the repository also - it's just at
> https://highgate.net.nz/
The patch below should work around this with neon 0.24.2, thanks for
making the server available. (it would help if you could leave it
available too so I can work out whether the test suite is woefully
inadequate in not catching this, or just that your server config is
strange)
Index: src/ne_openssl.c
===================================================================
RCS file: /home/cvs/neon/src/ne_openssl.c,v
retrieving revision 1.28
diff -u -r1.28 ne_openssl.c
--- src/ne_openssl.c 14 Sep 2003 11:19:45 -0000 1.28
+++ src/ne_openssl.c 30 Sep 2003 16:13:49 -0000
@@ -507,6 +507,15 @@
sock = ne_sock_sslsock(sess->socket);
chain = SSL_get_peer_cert_chain(sock->ssl);
+ if (chain == NULL) {
+ X509 *c = SSL_get_peer_certificate(sock->ssl);
+
+ if (c) {
+ chain = sk_X509_new_null();
+ sk_X509_push(chain, c);
+ }
+ }
+
if (chain == NULL || sk_X509_num(chain) == 0) {
ne_set_error(sess, _("SSL server did not present certificate"));
return NE_ERROR;
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: SSL related error
Posted by Tobias Ringstrom <to...@ringstrom.mine.nu>.
Nick Wright wrote:
> I suspect there is some sort of issue with the way I have Apache/SSL set up..
> I'm fairly new to the SSL side of things especially..
Did you try to create a self-signed certificate? If so, how did you do
it? It looks a little strange. You can use the following to create a
nice self signed certificate (and a key of course):
openssl req -x509 -nodes -days 3650 -newkey rsa:1024 \
-keyout key.pem -out cert.pem
I'm not saying that your certificate is strange, only that it *might*
be... :-)
It's also possible that Joe wants to look closer at your old cert if you
decide to change it.
> Anything to do with the "dropped support for PEM-encoded client certs, only
> accept PKCS12 now" thing new in NEON 0.24 perhaps?
No, this concerns the server cert, not the client cert.
/Tobias
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: SSL related error
Posted by Nick Wright <ni...@lsd.net.nz>.
I suspect there is some sort of issue with the way I have Apache/SSL set up..
I'm fairly new to the SSL side of things especially..
Anything to do with the "dropped support for PEM-encoded client certs, only
accept PKCS12 now" thing new in NEON 0.24 perhaps?
The server runs Debian testing/unstable, Apache/2.0.47 (Debian GNU/Linux),
DAV/2 SVN/0.30.0, mod_ssl/2.0.47, OpenSSL/0.9.7b
If you havent done so already, the output from the openSSL client is posted
below.
You can try connecting to the repository also - it's just at
https://highgate.net.nz/
The error happens before authentication.
(I use the HTTPS server only for subversion at the moment, so I just made the
root of the HTTPS server point to the repository)
Thanks,
Nick.
CONNECTED(00000003)
depth=0 /C=NZ/ST=Otago/O=None/OU=Svn/CN=highgate.net.nz
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 /C=NZ/ST=Otago/O=None/OU=Svn/CN=highgate.net.nz
verify error:num=27:certificate not trusted
verify return:1
depth=0 /C=NZ/ST=Otago/O=None/OU=Svn/CN=highgate.net.nz
verify error:num=21:unable to verify the first certificate
verify return:1
---
Server certificate
-----BEGIN CERTIFICATE-----
MIICOzCCAaQCAQEwDQYJKoZIhvcNAQEEBQAweDENMAsGA1UEChMETm9uZTEeMBwG
CSqGSIb3DQEJARYPbmlja0Bsc2QubmV0Lm56MRAwDgYDVQQHEwdEdW5lZGluMQ4w
DAYDVQQIEwVPdGFnbzELMAkGA1UEBhMCTloxGDAWBgNVBAMTD2hpZ2hnYXRlLm5l
dC5uejAeFw0wMzA4MjUwMTQ1MDdaFw0wNDA4MjQwMTQ1MDdaMFQxCzAJBgNVBAYT
Ak5aMQ4wDAYDVQQIEwVPdGFnbzENMAsGA1UEChMETm9uZTEMMAoGA1UECxMDU3Zu
MRgwFgYDVQQDEw9oaWdoZ2F0ZS5uZXQubnowgZ8wDQYJKoZIhvcNAQEBBQADgY0A
MIGJAoGBAKXrCcMgI+RwdjYB6yoYn8vMtuBqPmKzX21uQoN787mBHRqsS+iQlTn0
f/VD+fLx0eqTDj1B+tUFShQ6nd9Rkj++RNSAewf4usd6KVusrLOJvRef7wL93NFF
909TaqbRG5fzDyIsfmKcvD1t09HKLO2abNKYwJIhvPcHZ/u1jVIDAgMBAAEwDQYJ
KoZIhvcNAQEEBQADgYEAENzVEom2VyFms97uaiwuSMvCoTMdjva0g9BeoiBVLhU3
IElrHsT/PfiwggexIM6QptBKt35dWHUJtvqIZQeZV/yXtb9t0ui+ZRqmqrrNHAeG
WwuQkb2y2qSLd+r9x/Z/vyigHatoonDhzbI7p6qIdjNNTKREqmwaQEza2K+K6S4=
-----END CERTIFICATE-----
subject=/C=NZ/ST=Otago/O=None/OU=Svn/CN=highgate.net.nz
issuer=/O=None/emailAddress=nick@lsd.net.nz/L=Dunedin/ST=Otago/C=NZ/CN=highgate.net.nz
---
No client certificate CA names sent
---
Ciphers common between both SSL endpoints:
RC4-MD5 EXP-RC4-MD5 RC2-CBC-MD5
EXP-RC2-CBC-MD5 DES-CBC-MD5 DES-CBC3-MD5
RC4-64-MD5
---
SSL handshake has read 727 bytes and written 333 bytes
---
New, SSLv2, Cipher is DES-CBC3-MD5
Server public key is 1024 bit
SSL-Session:
Protocol : SSLv2
Cipher : DES-CBC3-MD5
Session-ID: 36F68149D191AA04AE74E0F7F7A266EE
Session-ID-ctx:
Master-Key: 38136ECC69B918B3156F90A34737CFD51622D724A29A0E28
Key-Arg : 835AF1A8257D71B2
Start Time: 1064934091
Timeout : 300 (sec)
Verify return code: 21 (unable to verify the first certificate)
---
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: SSL related error
Posted by Joe Orton <jo...@manyfish.co.uk>.
On Tue, Sep 30, 2003 at 01:24:32PM +0100, Joe Orton wrote:
> On Tue, Sep 30, 2003 at 11:14:39PM +1200, Nick Wright wrote:
> > OK - it seems that there is something different with the version that comes
> > with debian.. the debug thing doesnt seem to work there, is there a compile
> > switch or something? Here is the output from a version that I compiled
> > myself:
>
> The Debian package is probably built with --disble-debug
>
> ...
> > Sending request-line and headers:
> > Connecting to 203.79.84.1
> > Doing SSL negotiation.
> > Closing connection.
> > Connection closed.
>
> Weird - what does "openssl s_client -connect 203.79.84.1:443"
Ah, that would not be a 192.168.* address any more :) I can debug this
from here, thanks.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: SSL related error
Posted by Philip Martin <ph...@codematters.co.uk>.
Joe Orton <jo...@manyfish.co.uk> writes:
> The Debian package is probably built with --disble-debug
Yes, the Debian package I use is built that way.
--
Philip Martin
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: SSL related error
Posted by Joe Orton <jo...@manyfish.co.uk>.
On Tue, Sep 30, 2003 at 11:14:39PM +1200, Nick Wright wrote:
> OK - it seems that there is something different with the version that comes
> with debian.. the debug thing doesnt seem to work there, is there a compile
> switch or something? Here is the output from a version that I compiled
> myself:
The Debian package is probably built with --disble-debug
...
> Sending request-line and headers:
> Connecting to 203.79.84.1
> Doing SSL negotiation.
> Closing connection.
> Connection closed.
Weird - what does "openssl s_client -connect 203.79.84.1:443"
give from the client? What version of httpd and what platform is the
server running on?
joe
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: SSL related error
Posted by Nick Wright <ni...@lsd.net.nz>.
OK - it seems that there is something different with the version that comes
with debian.. the debug thing doesnt seem to work there, is there a compile
switch or something? Here is the output from a version that I compiled
myself:
Creating request...
Running request create hooks.
Request created.
Doing DNS lookup on highgate.net.nz...
Running pre_send hooks
Sending request headers:
PROPFIND /trunk/foo HTTP/1.1
Host: highgate.net.nz
User-Agent: SVN/0.29.0 (r6976) neon/0.24.1
Keep-Alive:
Connection: TE, Keep-Alive
TE: trailers
Content-Length: 300
Content-Type: text/xml
Depth: 0
Sending request-line and headers:
Connecting to 203.79.84.1
Doing SSL negotiation.
Closing connection.
Connection closed.
Running destroy hooks.
Request ends.
svn: RA layer request failed
svn: PROPFIND request failed on '/trunk/foo'
svn: PROPFIND of '/trunk/foo': SSL server did not present certificate
(https://highgate.net.nz)
ne_session_destroy called.
ne_session_destroy called.
Thanks,
Nick.
> Are you sure you're putting it in the right servers file? It works fine
> here with subversion 0.30.0.
>
> > I tried going back to version 0.26 and everything works fine again,
> > though I don't see why I should need to do that to "fix" this problem.
>
> Of course you should not have to. It's look like there could be a bug in
> neon, but Joe needs your help to track it down. Subversion 0.29 switched
> from neon 0.23.x to neon 0.24.x, and that's probably why the problems
> appeared in that version.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: SSL related error
Posted by Tobias Ringstrom <to...@ringstrom.mine.nu>.
Nick Wright wrote:
> Hi,
>
> That didn't produce any additional output on stderr (or anywhere else).
> I just put
>
> [global]
> neon-debug-mask=259
>
> at the bottom of the servers file - everything else was commented out. Is that
> what you mean?
Are you sure you're putting it in the right servers file? It works fine
here with subversion 0.30.0.
> I tried going back to version 0.26 and everything works fine again, though I
> don't see why I should need to do that to "fix" this problem.
Of course you should not have to. It's look like there could be a bug in
neon, but Joe needs your help to track it down. Subversion 0.29 switched
from neon 0.23.x to neon 0.24.x, and that's probably why the problems
appeared in that version.
/Tobias
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: SSL related error
Posted by Nick Wright <ni...@lsd.net.nz>.
Hi,
That didn't produce any additional output on stderr (or anywhere else).
I just put
[global]
neon-debug-mask=259
at the bottom of the servers file - everything else was commented out. Is that
what you mean?
I tried going back to version 0.26 and everything works fine again, though I
don't see why I should need to do that to "fix" this problem.
Nick.
> Curious - can you add
>
> neon-debug-mask=259
>
> to the [global] section of your ~/.subversion/servers file, and capture
> the stderr output when running the above command and post that?
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: SSL related error
Posted by Joe Orton <jo...@manyfish.co.uk>.
On Mon, Sep 29, 2003 at 08:34:57PM +1200, Nick Wright wrote:
> Hi, can anyone tell me how to fix this problem?
>
> When try to access my repository over https, I get the following error:
>
> nick@highgate: nick> svn co https://192.168.1.1/trunk/foo ./test
> svn: RA layer request failed
> svn: PROPFIND request failed on '/trunk/foo'
> svn: PROPFIND of '/trunk/foo': SSL server did not present certificate
> (https://192.168.1.1)
>
> I get the same error connecting from inside my LAN as well as from computers
> elsewhere.
>
> I had this working fine until I upgraded to subversion 0.29 (now running
> version 0.30).
Curious - can you add
neon-debug-mask=259
to the [global] section of your ~/.subversion/servers file, and capture
the stderr output when running the above command and post that?
> I can connect to my https web server with a browser just fine too. The server
> has a self-signed certificate authority key and server key.
>
> Thanks for any help.
> Nick.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
> For additional commands, e-mail: users-help@subversion.tigris.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org