Re: [viewvc-users] Security certificate issues [SEC=UNCLASSIFIED]

On 02/08/2011 06:36 PM, [email protected] wrote:
> Hi All,
> 
> I have had ViewVC 1.0.5 setup on our server. We have distributed the URL
> (https://gnsvn.globaldial.com/viewvc/geonetwork.asdd/) to some people but
> when they (and I) connect to it there is a 'security error'.

Well, you just effectively distributed this URL to the whole world.  This is
a public mailing list.  Hope that's not a problem for you.

> It appears that the certificate is 'self signed' and this is not to be
> trusted by some browsers. Eg. IE7 and FireFox 3.6.13 I'm sure that there
> are more.
> 
> If one accepts the certificate or continues one can see the ViewVC
> files.
> 
> Is there some way that I can provide a certificate that doesn't cause
> this error?
> 
> Thanks in advance for any help you can provide.
> 
> John Hockaday

Yours is not a ViewVC-specific problem, but a problem with your web server
configuration that would show up regardless of whether you were using
ViewVC.  Still, maybe I can at least get you pointing in the right direction.

Indeed, a self-signed certificate[1] is not to be trusted.  That's really a
core part of a certificate-based security model -- if just anybody can whip
up a certificate and have it be automatically trusted by all, that really
doesn't inspire confidence.  The solution, as I understand it, is to get
(that is, buy) a certificate that is issued and recognized as trustworthy by
a certificate authority (such as RSA, Thawte, Verisign, etc.).  Be
forewarned -- I don't believe that these things come cheaply, though!  I see
that Thawte has an SSL FAQ[2] you might find handy.

It doesn't appear that you are requiring login credentials for your ViewVC
site, so is it necessary that you expose it via SSL at all?  Another way to
avoid this is to just use plain old HTTP-without-the-S.  But I don't know
all your hosted services -- maybe there's some other reason you need SSL.

Sorry, but that's about the extent of my helpfulness here, though.  I've
never purchased a CA-issued cert myself.

Good luck!

-- C-Mike

[1] http://en.wikipedia.org/wiki/Self-signed_certificate
[2]
http://www.thawte.com/resources/ssl-information-center/get-started-with-ssl/ssl-faq/

-- 
C. Michael Pilato <[email protected]>
CollabNet   <>   www.collab.net   <>   Distributed Development On Demand

------------------------------------------------------
http://viewvc.tigris.org/ds/viewMessage.do?dsForumId=4255&dsMessageId=2702904

To unsubscribe from this discussion, e-mail: [[email protected]].

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAk1R7Y0ACgkQokEGqRcG/W5RCACfdz+zNXhERrDc7lTL+cTuOifl
J6oAn05ETR1lzwxvD/12o15Bw+ppHYrU
=a7lu
-----END PGP SIGNATURE-----