GNOME Bugzilla – Bug 356965
If a certificate is valid but untrusted, the error message should say UNTRUSTED, not BAD
Last modified: 2014-04-16 09:38:12 UTC
Please describe the problem: Forwarded from https://launchpad.net/distros/ubuntu/+source/evolution/+bug/19065 When trying to view a Sun Microsystems newsletter, I get about six messages warning me that the SSL certificate for promo-manager.server-secure.com is bad. One sample image URL referred to in the message is <https://promo-manager.server-secure.com/users/WC-408060/images/22936.jpg>. The full equivalent message can be viewed at < https://promo-manager.server-secure.com/pm/view_email.php?id=15464&u=1986>. The SSL certificate was issued by Comodo, a certificate authority (CA) I've never heard of, but Firefox happily opens URLs on this site and claims the certificate is valid. I'd like to If I knew where to go to add a CA in Evolution/gtkhtml, I'd do so, but there's no user interface for this that I can find. If the missing CA is the reason for these messages, I'd like you to consider updating your CA list. The reporter than goes on to say: If Firefox (and presumably also Thunderbird) regard the Cybertrust root as trusted, then I think Evolution should also trust it (or at least investigate trusting it). If a certificate is valid but untrusted, the error message should say UNTRUSTED, not BAD. Steps to reproduce: 1. Receive an email with images with https:// links, where the CA is not in the trusted list of evolution 2. See the message saying the certificate is "Bad" Actual results: A message appears which says the certificate is Bad. Expected results: If Firefox (and presumably also Thunderbird) regard the Cybertrust root as trusted, then I think Evolution should also trust it (or at least investigate trusting it). If a certificate is valid but untrusted, the error message should say UNTRUSTED, not BAD. Does this happen every time? Yes. Other information:
distribution bug comment "For record, the offending code for certificate prompt is in evolution-data-server-1.12.0/camel/camel-tcp-stream-ssl.c:865. I would fix it, but I don't know how evolution stores settings - some certificate identifiers (probably issuer and fingerprint?) must be stored in gconf so that they are recognized on subsequent runs."
This is currently obsolete (3.10/3.12), the dialog shows more accurate information now, including the certificate information itself, thus I'm closing this.