Bug 164086 - Accept SSL certificate forever does not work
Summary: Accept SSL certificate forever does not work
Status: RESOLVED FIXED
Alias: None
Product: kdelibs
Classification: Frameworks and Libraries
Component: general (show other bugs)
Version: SVN
Platform: Compiled Sources Linux
: NOR normal
Target Milestone: ---
Assignee: kdelibs bugs
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2008-06-14 19:42 UTC by Frederik Himpe
Modified: 2009-02-02 00:34 UTC (History)
2 users (show)

See Also:
Latest Commit:
Version Fixed In:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Frederik Himpe 2008-06-14 19:42:28 UTC
Version:           1.9.51 (using Devel)
Installed from:    Compiled sources

I connect to an IMAPs server with a self-signed certificate. I click to accept the certificate forever, but when I close kontact and start it up again, the message comes up again:
The server failed the authenticity check (192.168.100.1).

The host name did not match any of the valid hosts for this certificate
The certificate is self-signed, and untrusted
The certificate has expired
Comment 1 Torgny Nyblom 2008-06-15 19:42:19 UTC
Do you still have this problem with a current version (from trunk)?
I've had the same problem but it has disappeared some days ago.
Comment 2 Thomas McGuire 2008-06-17 18:26:38 UTC
I've seen the problem as well.
For me, it turned out that the certificate was different each time (different expiry date and MD5 although it came from the same IP).

In any case, this is a KSSL bug, which lives in kdelibs, moving the bug to there.
Comment 3 Andreas Hartmetz 2008-07-04 13:15:24 UTC
Torgny Nyblom is right :) - this has been fixed in revision 784963 on 2008-03-12 after the bug had been reported to me on IRC. I would be surprised to hear that it is still present...
Frederik: Please reopen if the bug is still there in a recent SVN version or Beta.
Comment 4 Frederik Himpe 2008-07-04 13:54:02 UTC
No, this bug happens for me in KDE 4.0.84 as currently included in Mandriva Cooker.
Comment 5 Andreas Hartmetz 2008-07-04 17:21:25 UTC
Frederik, I need at least a test URL to reproduce or further evaluate this bug. There have been no other bug reports like that recently and I have not seen any problems like that myself for some time so I suspect it's a site issue.
Presenting a different certificate every time, by the way, is a very stupid thing to do for a server. It removes even the guarantee that this is the same site as last time with the same (self-signed / unverifiable / ...) certificate.
Comment 6 Michael Braun 2008-07-04 19:52:05 UTC
Hi,
I've got the same problem with my IMAP Account and SSL. I use a self signed certificate which isn't signed for my domain. So I get the messsage that it is self-signed and if I start e.g. konqueror  I get the message that the certificate isn't created for my domain. But the connection is possible and konqueuror can save it forever.

Michael
Comment 7 Frederik Himpe 2008-07-04 22:49:51 UTC
The server is not sending a different certificate every time: the MD5 as reported by KMail is the same. I've never had a similar problem with Evolution, KMail from KDE 3.5 or Claws Mail.

It's a simple Dovecot installation Debian, but the certificate is self-signed, has an invalid cn and is expired. I send you the address in private.
Comment 8 WALRANT Alain 2008-07-08 23:08:35 UTC
Same problem with KMAIL on opensuse 11.0 (The server failed the authenticity check - The certificate is self-signed, and untrusted).

- opensuse 11.0 (kernel 2.6.25.5-1.1-default #1 SMP 2008-06-07 01:55:22)
- x86_64 
- kmail version 1.9.51
- KDE 4.0.4 (KDE 4.0.4 >=20080505) "release 15.1"

I've been using KMAIL on POP3S on the same server for month without any such problem. However the POP3S server changed IP and the problem raised since then.  
Certificate is not expired but self-signed.
kmail keep complaining on the certificate'authenticity and there is no mean to accept it forever.
  
Comment 9 Andreas Hartmetz 2009-02-02 00:34:13 UTC
Fixed with commit 914920 which also fixed bug #178229.
KConfig got confused by binary group names and couldn't find them, hence saved rules could not be retrieved.