svn won't accept my invalid certificate

Error validating server certificate for 'https://server:443':
 - The certificate is not issued by a trusted authority. Use the
   fingerprint to validate the certificate manually!
 - The certificate hostname does not match.
Certificate information:
 - Hostname: Tom
 - Valid: from Sun, 01 Feb 2009 03:51:25 GMT until Tue, 01 Feb 2011 03:51:25 GMT
 - Issuer: Fake Company, NYC, New York, US
 - Fingerprint: fingerprint here

The problem is that your certificate does not match your server's hostname. You need the CN field in the certificate to match your hostname. In yuor case, your hostname is "server" and your certificate's CN is "Tom". You need to regenerate your certificate with the correct CN value.

One thing to note - many cron jobs run w/ a different HOME (e.g. /etc/crontab (cron.daily etc) sets HOME=/) so it has a different .subversion file. Just bit us here and there was a /.subversion tree w/o the accepted cert. Setting HOME correctly in the cron script fixed it.

Did you try to set ssl-trust-default-ca to true? I dont know if will solve your problem but I saw this recomendation at Version Control with Subversion book.

Many OpenSSL installations also have a pre-defined set of “default” CAs that are nearly universally trusted. To make the Subversion client automatically trust these standard authorities, set the ssl-trust-default-ca variable to true.

just add this to the arguments

--trust-server-cert-failures="other,unknown-ca,cn-mistmatch,expired" 

There's a couple of solutions to get around the problem that come to mind. First, you could create a new webdav virtual host in Apache that does not use this certificate (plain http). Alternatively, you could use the svn+ssh access method and private key authentication for the cron job (may be a security risk).

I'd only go this route if you can't fix the problems with the certificate, or aren't tied to https webdav access though.

you can just:

echo t | svn update --username yourusername--password yourpassword --no-auth-cache /local.repository/path 2>/dev/null

The answers to this question helped me assemble the pieces needed to solve a similar problem i was having. This is just to pre-assemble the pieces for other linux noobs like me.

to test the script you run via cron use

sudo su

instead of what I was using

sudo -s

otherwise the home directory and other variables won't be as when it is run by cron(root)

secondly don't use "--no-auth-cache". If you add that switch you can never permanently accept the certificate.

using the above, I was able to run the script once via sudo su, accept the certificate permanently and subsequent cron runs worked.

You might try validating the certificate manually:

$ openssl x509 -noout -fingerprint -in cert.pub
MD5 Fingerprint=0D:89:07:D6:4F:BC:84:2E:2E:14:C2:DA:D4:3B:D5:7C

Put this in your script:

# svn up /BACKUP/checkouts/server/ --username tom –config-dir /xyz/zyx

config-dir could be anything where you want to store the certificate information. Before running it from the cron, run it manually and accept the certificate permanently, using "p".

Once accepted, run it through cron and I believe it will work like a charm.

There is one more option (if previous option doesn't work by any chance), which is kind of risky in other environments, but in your environment, it should be fine. Use the script something like this:

# svn up /BACKUP/checkouts/server/ --username tom --non-interactive –-trust-server-cert

This will simply accept the certificate without bothering. This is not advised in the production environment because this is kind of a security risk, but in your case, where you are using self made certificate, you can use it.

Source: GeekRide