SSL handshake failed: SSL 錯誤:在證書中檢測到違規的密鑰用法。


問題:在WINDOWS中創建的SVN Server,在Linux client中無法連接。
原因:WINDOWS中的證書無法被Linux正確識別,因此需要修改證書,以使雙方都可以正確識別。

修改方法如下:(在網上搜到的解決辦法,特放在這里以備忘。)

http://www.visualsvn.com/support/topic/00056/

Symptoms
Subversion clients receive the following error message when attempting to connect to VisualSVN Server:
svn: OPTIONS of 'https://server.domain.local/svn/repo': SSL handshake failed: SSL error:
Key usage violation in certificate has been detected. (https://server.domain.local)
You may experience the issue if both of the following conditions are met:
VisualSVN Server has a self-signed certificate applied and
Subversion client is built against the GnuTLS library.

Note
GnuTLS library is an alternative to OpenSSL. Most Subversion clients for Windows are built against OpenSSL and are not affected by this issue. While some Subversion packages (available mostly on Linux-based operating systems such as Ubuntu and Debian) are built against GnuTLS and are affected.
Technical background
During the initial setup VisualSVN Server 2.5 generates a self-signed certificate and adds it to the Trusted Root Certification Authorities store on the local machine. To avoid possible security issues, VisualSVN Server makes this self-signed certificate to be valid for server authentication only (by specifying the 'Key Usage' extension). Subversion clients built against GnuTLS don't recognize such certificate and the error occurs.
Workaround
It's not recommended to use a self-signed certificate in a production environment. We advise to use a certificate issued by your domain or a third-party certificate authority instead of a self-signed one.
If you have to use a self-signed certificate please follow the instruction to generate a cerificate without specifying 'Key Usage' extension:
1、Add the following registry value to the Windows registry:
for 32-bit system:
[HKEY_LOCAL_MACHINE\SOFTWARE\VisualSVN\VisualSVN Server]
"CreateGnuTLSCompatibleCertificate"=dword:00000001
     
for 64-bit system:
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\VisualSVN\VisualSVN Server]
"CreateGnuTLSCompatibleCertificate"=dword:00000001
     
2、Start VisualSVN Server Manager.
3、Go to Action | Properties | Certificate.
4、Click Change certificate... and follow the wizard instructions to generate a new self-signed certificate.
The certificate will be generated without the 'Key Usage' extension and will be compatible both with GnuTLS and OpenSSL.


免責聲明!

本站轉載的文章為個人學習借鑒使用,本站對版權不負任何法律責任。如果侵犯了您的隱私權益,請聯系本站郵箱yoyou2525@163.com刪除。



 
粵ICP備18138465號   © 2018-2025 CODEPRJ.COM