Question

I’m trying to access an SVN server that I’ve been using for some time now, but now I’m receiving this error:

SSL handshake failed: SSL error: A TLS warning alert has been
received.

On other machines (all of this is being done on CentOS) , with which I have not previously accessed the server, I am prompted with the (R)eject, accept (t)emporarily or accept (p)ermanently? options for the offered certificate, and then I am able to successfully connect. My conclusion is that the old certificate is cached and that I need to obtain a new one, however, I have not been able to find a way to clear it and once again receive this prompt when running svn.

I did read many similar issues to this, which led me to clearing/deleting my .subversion folder, but even after that it still won’t prompt me about the certificate and it continues to fail with the above error. Any ideas?

Answer 1

You did not specify which version of CentOS you are experiencing this issue on.

The subversion that comes with EL 6 is linked against GnuTLS which is a change from older releases which linked against OpenSSL.

You can test this using ldd:

$ ldd /usr/bin/svn | grep ssl
$ ldd /usr/bin/svn | grep tls
        libgnutls.so.26 => /usr/lib/libgnutls.so.26 (0x0030f000)
$

The GnuTLS libraries are more particular in certain cases. The two most common ones:

1. The remote site uses a weak cipher like DES.
2. The remote site has a certificate which has a name that does not match the name you specified.

In the case of a name mismatch you can side step the issue by using the IP address instead of the name. If the host is foo.com and has IP address 1.2.3.4 you can try something along the lines of:

svn switch --relocate https://foo.com/my-repo-name https://1.2.3.4/my-repo-name

You could also try building subversion from the source code and using openssl instead of gnutls in the configuration.