Subversion 1.5.1 does not work with SSL certificates

We're all stuck at our company too now until we can authenticate with our openssl certs. Me at home too.

Could there not be a choice of packages, one for libneon and one for libneon-gnutls?

Desperately awaiting a resolution to this, as we're just a little stuck!

The debian bug page describes 2 workarounds:

  1. If you have access to a Windows machine running IE, import your .p12 and export it as a PFX file (.pfx). One of my colleagues here has tried this and it worked (although not with a passwordless .pfx it seems)
  2. Swap the libraries:
        # cd /usr/lib/
        # mv libneon-gnutls.so.27 libneon-gnutls.so.27.old
        # mv libneon-gnutls.so.27.1.2 libneon-gnutls.so.27.1.2.old
        # ln -s libneon.so.27 libneon-gnutls.so.27

Thank you, Peter.

I can confirm the second workaround you've posted.

Reading this:

http://www.drh-consultancy.demon.co.uk/pkcs12faq-old.html#PFX

I'm not convinced the .pfx solution is real.

I've attached a debdiff that will switch building SVN from gnutls to openssl again. As I can't test to see if it resolves the issue, I've uploaded the package to the backport testers PPA (https://edge.launchpad.net/~ubuntu-backports-testers/+archive)

Marking this as Triaged, pending testing.

Thanks Michael, the package you uploaded works;

I've found a solution that works with libneon27-gnutls. The problem appears to be that it does not correctly handle having the CA certificates in the .p12

To extract the PEMs from your current p12:
  openssl pkcs12 -in CURRENT.p12 -nodes -nocerts > private.key.pem
  openssl pkcs12 -in CURRENT.p12 -nodes -nokeys > public.key.pem

Then in public.key.pem I deleted all which weren't my certificate, then I repackaged it with:
  openssl pkcs12 -export -inkey private.key.pem -in public.key.pem -out NEW.p12

Marked as In Progress since verification is complete. If there is a workaround for GnuTLS, it may be preferable not to make this change. Scott, your comments?

Moving back to Triaged. I'm an idiot; forgot about the meaning of In Progress for Backports :-).

1.5.1dfsg1-1ubuntu2~hardy2 accepted to hardy-backports.

Bug is also in 8.10 the pem conversion does not work. So maybe this problems needs to be reopened

Please file a new but for that.