Bug 1207035

Summary: Custom SSL certificate not accepted for hosted owncloud installation
Product: [Fedora] Fedora Reporter: Amit Shah <amit.shah>
Component: evolution-data-serverAssignee: Milan Crha <mcrha>
Status: CLOSED NEXTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 22CC: amit.shah, debarshir, mbarnes, mcrha
Target Milestone: ---Keywords: Reopened
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: evolution-data-server-3.16.3 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-05-28 08:41:57 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Amit Shah 2015-03-30 06:12:13 UTC
Description of problem:

I have an owncloud installation accessible only via https, but the certificate belongs to a subdomain that's different from the subdomain I access the owncloud install.

goa prompts once for accepting such a cert, but continues to not proceeding with login, saying the website has invalid credentials.

Version-Release number of selected component (if applicable):
gnome-online-accounts-3.15.91-1.fc22.x86_64

Comment 3 Amit Shah 2015-05-07 18:00:59 UTC
With gnome-3.16, gnome-online-accounts seems to accept the cert, but evolution isn't accepting it.  I'm sending you credentials to a private owncloud repository, please check if the bug needs to be re-assigned to evolution.

Comment 4 Debarshi Ray 2015-05-14 13:52:43 UTC
(In reply to Amit Shah from comment #0)
> Description of problem:
> goa prompts once for accepting such a cert, but continues to not proceeding
> with login, saying the website has invalid credentials.

Did the account get added to the Online Accounts panel in settings? I tried the test account that you created for me, and after clicking "ignore" the new account did get added to the panel.

Are you sure you didn't actually enter invalid credentials?

(In reply to Amit Shah from comment #3)
> With gnome-3.16, gnome-online-accounts seems to accept the cert, but
> evolution isn't accepting it.

Just after the account got added, evolution threw a serious of certificate dialogs at me. I guess, that is because I always chose "accept temporarily". I can see the ownCloud calendar under the "Calendar" tab in evolution. I was also able to mount the ownCloud volume in nautilus and open the user manual PDF.

> I'm sending you credentials to a private
> owncloud repository, please check if the bug needs to be re-assigned to
> evolution.

Many thanks for this!

Comment 5 Milan Crha 2015-05-14 14:57:53 UTC
(In reply to Amit Shah from comment #3)
> With gnome-3.16, gnome-online-accounts seems to accept the cert, but
> evolution isn't accepting it.  I'm sending you credentials to a private
> owncloud repository, please check if the bug needs to be re-assigned to
> evolution.

I can confirm this misbehaviour on the evolution(-data-server) side. One part is correct, when the account is added, the discovery of the ownCloud sources fails with "HTTP/1.1 6 Unacceptable TLS certificate", which is completely fine and expected.

User is supposed to open the evolution (or other credentials capable eds client), where is shown that the certificate is not trusted and an option to View Certificate is offered.

The problem comes when the View Certificate button is clicked. Instead of showing a dialog to accept or reject the certificate a runtime warning is shown on the console:
> e-data-server-CRITICAL **: e_source_webdav_verify_ssl_trust: assertion 'host != NULL' failed

and bad luck. I use git master of the evolution-data-server and evolution.

This will be fixed, probably in the evolution-data-server, but can be also in the evolution. I cannot tell for sure right now.

As you have an upstream bug opened, and this is not a Fedora specific issue, and I do not like duplicating the work, I'm moving with any further work to your upstream bug report.

Comment 6 Milan Crha 2015-05-14 15:03:07 UTC
Hmm, http://bugzilla.gnome.org/show_bug.cgi?id=722832 is not suitable, I opened https://bugzilla.gnome.org/show_bug.cgi?id=749385 instead.

Comment 7 Milan Crha 2015-05-22 14:57:11 UTC
I just committed a fix upstream, for evolution-data-server 3.16.3+ and 3.17.2+.

Comment 8 Amit Shah 2015-05-28 04:51:34 UTC
Re-opening, since the fix isn't available in Fedora yet.  Can you please mark this fixed in the 3.16.3 update that Fedora gets, so it's automatically closed when the update is submitted?  Thanks.

Comment 9 Milan Crha 2015-05-28 08:41:57 UTC
The 3.16.3 is planned for June 8th, and I'll surely forget of this bug when I'll do the update for the Fedora, thus it's easier for me to just close this. The idea of Closed/Upstream is that the issue is not Fedora specific, at least from my point of view, thus the resolution was correct.