With the
letsencrypt CA you can create ssl certificates to protect your http servers with a valid certificate.
These certificates are valid 90 days and the can be auto renewed, so your services won't interrupt.
For normal apache / nginx installations there are plenty of documentations on how to install and use such certificates.
Unfortunately with
subversion edge, it does not just work out of the box, but it uses a apache http server for http/https communication.
So what's the problem?
Let's look at a standard subversion edge installation under debian:
- The certificates are stored in /opt/csvn/data/conf in the files server.crt and server.key
- The configuration for the ssl certificates are in the csvn_main_httpd.conf file, which is generated at each restart
- In the csvn_main_httpd.conf file we only have the two server.crt and server.key files referenced, but not the required intermediate certificate chain
The first thing to do is generate a ssl certificate for your server.
The http server root points to /var/www/html, so you can use that folder to generate your certificates
certbot certonly --webroot -w /var/www/html -d svn.example.com
This generates the certificates in /etc/letsencrypt/live/svn.example.com
To use them, you can now delete the two server.crt and server.key files in /opt/csvn/data/conf and create symbolic links to these files
server.crt -> /etc/letsencrypt/live/svn.example.com/cert.pem
server.key -> /etc/letsencrypt/live/svn.example.com/privkey.pem
But what about the SSLCertificateChainFile /etc/letsencrypt/live/svn.example.com/fullchain.pem file?
You can't add it to csvn_main_httpd.conf since this file is regenegated on each restart.
But fortunally you can add it into the https special config, where the chiper config is stored.
So just add it into the ssl_httpd.conf file
Now we have everything together and could start the https svn server.
Unfortunately this will fail with a error message like:
ERROR errors.GrailsExceptionResolver -
FileNotFoundException occurred when processing request:
[POST] /csvn/
/opt/csvn/data/conf/server.crt (Permission denied). Stacktrace follows:
java.io.FileNotFoundException: /opt/csvn/data/conf/server.crt (Permission denied)
at java.io.FileOutputStream.open(FileOutputStream.java:270)
at java.io.FileOutputStream.<init>(FileOutputStream.java:213)
at java.io.FileWriter.<init>(FileWriter.java:107)
Ok, so you are running subversion as non-root as recommended. (If not, then rethink what you are doing and reinstall subversion as a standard user)
To allow the subversion user to access the ssl certificates of letsencrypt, the simplest way is to add the subversion user to the ssl-cert group, and give the group rx access to the certificates in /etc/letsencrypt/live and /etc/letsencrypt/archive
Once this is done, you should be able to start the svn server with active letsenrcypt ssl certificates.
What remains to be done is the periodic renewal of the certificates, which is widely described in the Internet.
What you have to do, is to restart the https service when a new certificate is generated. Usually you can do this in the renew script.
