Bug 514316

Summary:	In Server Authentication dialog selecting Continue, then selecting Forever for accepting certificate has no effect
Product:	[Frameworks and Libraries] frameworks-kio	Reporter:	Jure Repinc <jlp>
Component:	general	Assignee:	KIO Bugs <kio-bugs-null>
Status:	REPORTED ---
Severity:	normal	CC:	kdelibs-bugs-null, nicolas.fella
Priority:	NOR
Version First Reported In:	6.21.0
Target Milestone:	---
Platform:	openSUSE
OS:	Linux
Latest Commit:		Version Fixed/Implemented In:
Sentry Crash Report:

Description Jure Repinc 2026-01-08 09:44:43 UTC

SUMMARY
It looks like that despite selecting Forever when asked if I want to accept a server certificate in Server Authentication dialog I keep getting asked for the same certificate. This happens even if I select the option "Do not ask again". This happens with the "tk.mabo.ltd" server and the dialog is triggered from KTorrent.

STEPS TO REPRODUCE
1.  Run KTorrent and seed a lot of Linux ISO torrents.
2. After some time a Server Authentication dialog with text "The server failed the authenticity check (tk.mabo.ltd). The certificate is self-signed and untrusted"
3. Click Continue
4. In the dialog that asks "Would you like to accept this certificate forever without being prompted?" click Forever (optionaly select the "Do not ask again" option)

OBSERVED RESULT
I keep getting the same Server Authentication dialogs for the same certificate server again and again 

EXPECTED RESULT
I expect to see these dialogs only if selecting Cancel in the dialogs

SOFTWARE/OS VERSIONS
Operating System: openSUSE Tumbleweed 20260106
KDE Plasma Version: 6.5.4
KDE Frameworks Version: 6.21.0
Qt Version: 6.10.1
Kernel Version: 6.18.3-1-default (64-bit)
Graphics Platform: Wayland
Processors: 16 × AMD Ryzen 7 7840HS w/ Radeon 780M Graphics
Memory: 32 GiB of RAM (30.7 GiB usable)
Graphics Processor: AMD Radeon 780M Graphics
KTorrent: 25.12.0

Comment 1 Nicolas Fella 2026-01-08 12:52:50 UTC

Using https://invent.kde.org/frameworks/kio/-/blob/master/autotests/http/sslerrortest.cpp?ref_type=heads it seems to work as expected with https://self-signed.badssl.com/, but not https://tk.mabo.ltd

Comment 2 Nicolas Fella 2026-01-08 13:08:17 UTC

tk.mabo.ltd seems to server a _different_ SSL certificate each time? Then remembering the certificate can't possibly work