Re: Sitecopy and certificate management

Timothee Besset <[email protected]> Wed, 12 Apr 2006 10:13:13 -0500

Newsgroups	gmane.comp.web.sitecopy
Message-ID	<[email protected]>

I had the same problem months ago, and no one came up with a working
solution, so I patched sitecopy myself ( neon actually ). See the
attached diff. Note that since it's a change in neon, you need to
compile sitecopy using the provided neon lib rather than the system one.

TTimo

Jesus Climent wrote:
> Hi.
>
> While trying to sync some data over a https tunnel, I get the following:
>
> $ sitecopy -u sitecopy
> sitecopy: Updating site `sitecopy' (on sitecopy.service.org in /repository/)
> sitecopy: Error: Server certificate verification failed: certificate issued for a different hostname, issuer is not trusted
>
> The certificate is accepted in the first attempt, but the following ones it
> refuses to update the site.
>
> Is there any way to avoid that check and force the syncing even with the
> "broken" cert?
>
> If there is no such way, could it be implemented? How much would it take to be
> done? Is there any way we could get it implemented?
>
>

_______________________________________________
sitecopy maillist  -  [email protected]
http://dav.lyra.org/mailman/listinfo/sitecopy

sitecopy.patch (text/x-patch, 3.3 KB)

Only in ../sitecopy-0.16.0: Makefile
Only in ../sitecopy-0.16.0: config.h
Only in ../sitecopy-0.16.0: config.log
Only in ../sitecopy-0.16.0: config.status
Only in ../sitecopy-0.16.0/intl: Makefile
Only in ../sitecopy-0.16.0/lib: basename.o
Only in ../sitecopy-0.16.0/lib: dirname.o
Only in ../sitecopy-0.16.0/lib/neon: Makefile
Only in ../sitecopy-0.16.0/lib/neon: libneon.a
Only in ../sitecopy-0.16.0/lib/neon: ne_207.o
Only in ../sitecopy-0.16.0/lib/neon: ne_alloc.o
Only in ../sitecopy-0.16.0/lib/neon: ne_auth.o
Only in ../sitecopy-0.16.0/lib/neon: ne_basic.o
Only in ../sitecopy-0.16.0/lib/neon: ne_compress.o
Only in ../sitecopy-0.16.0/lib/neon: ne_dates.o
Only in ../sitecopy-0.16.0/lib/neon: ne_locks.o
Only in ../sitecopy-0.16.0/lib/neon: ne_md5.o
diff -u -r sitecopy-0.16.0/lib/neon/ne_openssl.c ../sitecopy-0.16.0/lib/neon/ne_openssl.c
--- sitecopy-0.16.0/lib/neon/ne_openssl.c	2005-06-01 04:19:15.000000000 -0500
+++ ../sitecopy-0.16.0/lib/neon/ne_openssl.c	2005-09-19 11:47:50.000000000 -0500
@@ -386,7 +386,9 @@
         ne_set_error(sess, _("Server certificate was missing commonName "
                              "attribute in subject name"));
         return NE_ERROR;
-    } else if (ret > 0) failures |= NE_SSL_IDMISMATCH;
+    } 
+	/* TTimo - should be a warning thing, screw this */
+	/* else if (ret > 0) failures |= NE_SSL_IDMISMATCH; */
 
     /* get the result of the cert verification out of OpenSSL */
     result = SSL_get_verify_result(ssl);
@@ -399,7 +401,8 @@
     case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
     case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
 	/* TODO: and probably more result codes here... */
-	failures |= NE_SSL_UNTRUSTED;
+	  /* TTimo - fuck this. should be a warning or a prompt */
+	  /*	failures |= NE_SSL_UNTRUSTED; */
 	break;
 	/* ignore these, since we've already noticed them: */
     case X509_V_ERR_CERT_NOT_YET_VALID:
Only in ../sitecopy-0.16.0/lib/neon: ne_openssl.c~
Only in ../sitecopy-0.16.0/lib/neon: ne_openssl.o
Only in ../sitecopy-0.16.0/lib/neon: ne_props.o
Only in ../sitecopy-0.16.0/lib/neon: ne_redirect.o
Only in ../sitecopy-0.16.0/lib/neon: ne_request.o
Only in ../sitecopy-0.16.0/lib/neon: ne_session.o
Only in ../sitecopy-0.16.0/lib/neon: ne_socket.o
Only in ../sitecopy-0.16.0/lib/neon: ne_string.o
Only in ../sitecopy-0.16.0/lib/neon: ne_uri.o
Only in ../sitecopy-0.16.0/lib/neon: ne_utils.o
Only in ../sitecopy-0.16.0/lib/neon: ne_xml.o
Only in ../sitecopy-0.16.0/lib/neon: ne_xmlreq.o
Only in ../sitecopy-0.16.0/lib: netrc.o
Only in ../sitecopy-0.16.0/lib: rpmatch.o
Only in ../sitecopy-0.16.0/lib: yesno.o
Only in ../sitecopy-0.16.0/po: Makefile
Only in ../sitecopy-0.16.0/po: Makefile.in
Only in ../sitecopy-0.16.0/po: POTFILES
Only in ../sitecopy-0.16.0/po: stamp-po
Only in ../sitecopy-0.16.0: sitecopy
Only in ../sitecopy-0.16.0/src: common.o
Only in ../sitecopy-0.16.0/src: console_fe.o
Only in ../sitecopy-0.16.0/src: davdriver.o
Only in ../sitecopy-0.16.0/src: fileset.o
Only in ../sitecopy-0.16.0/src: ftp.o
Only in ../sitecopy-0.16.0/src: ftpdriver.o
Only in ../sitecopy-0.16.0/src: lsparser.o
Only in ../sitecopy-0.16.0/src: nulldriver.o
Only in ../sitecopy-0.16.0/src: rcfile.o
Only in ../sitecopy-0.16.0/src: rshdriver.o
Only in ../sitecopy-0.16.0/src: sftpdriver.o
Only in ../sitecopy-0.16.0/src: sitefiles.o
Only in ../sitecopy-0.16.0/src: sites.o
Only in ../sitecopy-0.16.0/src: sitestore.o