TAG | Apache
When connecting to Subversion repositories using SSL connections the SVN client checks the server certificate if it is not expired, if it’s host description matches the host of the repository and if the authority which signed the certificate is trusted.
If the certificate fails to comply with any of the above rules the SVN client will respond with a message such as this one:
Error validating server certificate for ‘https://hostname:443′:
– The certificate is not issued by a trusted authority. Use the
fingerprint to validate the certificate manually!
– Hostname: hostname
– Valid: from Tue, 16 Feb 2010 16:58:39 GMT until Fri, 14 Feb 2020 16:58:39 GMT
– Issuer: company.com, London, Berkshire, GB
– Fingerprint: d5:4e:d8:12:33:12:a5:f1:18:91:77:40:c4:77:3b:0b:f8:51:71:cd
(R)eject, accept (t)emporarily or accept (p)ermanently?
The certificate can still be accepted permanently manually. It may not be a solution if SVN commands are issued by non interactive processes. For example a PHP script run by apache trying to export a branch from the repository.
Certificates signed by trusted authorities such as Verisign should not have any problems. But self signed certificates will not be recognized by the SVN client which in turn will respond with the response above. Self signed certificates can be be made trusted by the SVN client by using the ssl-authority-files configuration option:
ssl-authority-files = /home/void/.subversion/company.crt
The configuration file named servers which holds this configuration option can be stored in multiple locations on the filesystem. First the Subversion client will try to look for it in the home folder of the user that is executing the SVN command. Users such as apache will most likely not have a home folder. In such cases SVN tries to look for the servers file in the /etc/subversion directory. It may or may not exist depending on the OS distribution flavour. For example it exits on Ubuntu but does not exist on CentOS a flavour of RedHat.
I was working on a small web application that creates Subversion branches and tags. In short it just executes SVN commands on the repository. Whenever a user executes an SVN command the SVN client tries to check user’s local home folder for the .subversion configuration directory. The issue that I was running into was that for some reason apache’s home folder was pointing to our system’s administrator home folder which in turn would result in a permission denied error when apache would try to access the .subversion folder.
It just didn’t make any sense. Turns out if you start a service through /etc/init.d/ it starts that service with environment variables belonging to the user that started the service. In this case our system’s administrator started the service using his own user.
To start services in a clean environment a special utility called service should be used. It usually resides in the /sbin directory. So for example instead of starting apache like this:
$ sudo /etc/init.d/httpd start
It should be started like this:
$ sudo /sbin/service httpd start
Which will result in $HOME environment variable being empty and the SVN client not getting a permission denied error.
Setting up virtual host on windows using apache and possibly XAMPP is easy but may cause some trouble to the inexperienced. To setup a virtual host follow these steps:
1. Locate your vhosts file. On my PC it’s: D:\apache\conf\extra\httpd-vhosts.conf
2. Uncomment the following line: NameVirtualHost *:80
3. Add your virtual host definition:
DocumentRoot "D:\www\myproject\" ServerName myproject.com Allow from all Options +Includes +Indexes +FollowSymLinks AllowOverride all
4. Open a file name hosts located at: C:\WINDOWS\system32\drivers\etc
5. Add the following line: 127.0.0.1 myproject.com
Check that for project path correct slashes are being used. Apache seems to not understand \ slashes and instead wants /. If you try and start apache from a command line it may output something like this:
Syntax error on line 45 of D:/XamppLite/apache/conf/extra/httpd-vhosts.conf:
DocumentRoot must be a directory