Redmine

Sorry, not expired ... untrusted.

As I mentioned, not expired, untrusted.

So ... yes, really.

Do you mean "Gandi, Paris, Paris, FR" is untrusted?

The certificate itself is fine and valid. However, it appears that the server for https://svn.redmine.org does not send along the required intermediate certificates to allow clients to verify the full certificate chain as shown in Toshi's gnutls trace.

Some clients (like most current browsers) cache intermediate certificates they have already seen somewhere else (e.g. from a visit to https://www.redmine.org) . This allows them to still verify the certificate chain even if the actual server does not send the required certificates along.

SVN clients usually don't do this (and don't even "visit" other sites). Thus, they have no way to learn about the intermediate certificate chain which is required to verify the server certificate. The clients only have their internal list of trusted root certificates. The solution would be to configure the webserver at https://svn.redmine.org to also send the intermediate certificates along, similar to how it's done for the main website at https://www.redmine.org. I think that right now only Jean-Philippe is able to perform this change.

I've just run into the same problem.

Please use SSLCertificateChainFile or SSLCertificateFile depending on Apache version.

You can see the problem here: https://www.ssllabs.com/ssltest/analyze.html?d=svn.redmine.org
"Chain issues Incomplete"

Please also check: https://mozilla.github.io/server-side-tls/ssl-config-generator/
to get acceptable TLS configuration instead of current insecure one.

Is there any progress?

I had a same issue.
https://github.com/agileware-jp/redmine-plugin-orb/pull/8#discussion_r291828335

I use following one-liner for now.

```
svn co --non-interactive --config-option servers:global:ssl-authority-files=<(curl -sL https://www.gandi.net/static/CAs/GandiStandardSSLCA2.pem) https://svn.redmine.org/redmine/trunk /tmp/redmine
```

the Gandi's intermediary certificates is listed here.
https://docs.gandi.net/en/ssl/documents/technical_documents.html