diff --git a/addressbook/backends/webdav/e-book-backend-webdav.c b/addressbook/backends/webdav/e-book-backend-webdav.c
index 53d3999..ac1156c 100644
--- a/addressbook/backends/webdav/e-book-backend-webdav.c
+++ b/addressbook/backends/webdav/e-book-backend-webdav.c
@@ -146,7 +146,7 @@ send_and_handle_ssl (EBookBackendWebdav *webdav,
 	guint status_code;
 
 	status_code = soup_session_send_message (webdav->priv->session, message);
-	if (status_code == SOUP_STATUS_SSL_FAILED) {
+	while (status_code == SOUP_STATUS_SSL_FAILED) {
 		ESource *source;
 		ESourceWebdav *extension;
 		ESourceRegistry *registry;
@@ -174,9 +174,22 @@ send_and_handle_ssl (EBookBackendWebdav *webdav,
 		    response == E_TRUST_PROMPT_RESPONSE_ACCEPT_TEMPORARILY) {
 			g_object_set (webdav->priv->session, SOUP_SESSION_SSL_STRICT, FALSE, NULL);
 			status_code = soup_session_send_message (webdav->priv->session, message);
+
+			if (SOUP_STATUS_IS_SUCCESSFUL (status_code) &&
+			    !e_source_webdav_ssl_trust_matches (extension, message)) {
+				status_code = SOUP_STATUS_SSL_FAILED;
+				soup_message_set_status (message, status_code);
+			} else {
+				break;
+			}
+		} else {
+			break;
 		}
 	}
 
+	if (status_code == SOUP_STATUS_SSL_FAILED)
+		g_object_set (webdav->priv->session, SOUP_SESSION_SSL_STRICT, TRUE, NULL);
+
 	return status_code;
 }
 
diff --git a/calendar/backends/caldav/e-cal-backend-caldav.c b/calendar/backends/caldav/e-cal-backend-caldav.c
index 58c70b6..d306d4d 100644
--- a/calendar/backends/caldav/e-cal-backend-caldav.c
+++ b/calendar/backends/caldav/e-cal-backend-caldav.c
@@ -1053,7 +1053,7 @@ send_and_handle_redirection (ECalBackendCalDAV *cbdav,
 	soup_message_headers_append (msg->request_headers, "Connection", "close");
 	soup_session_send_message (cbdav->priv->session, msg);
 
-	if (msg->status_code == SOUP_STATUS_SSL_FAILED) {
+	while (msg->status_code == SOUP_STATUS_SSL_FAILED) {
 		ESource *source;
 		ESourceWebdav *extension;
 		ESourceRegistry *registry;
@@ -1081,9 +1081,20 @@ send_and_handle_redirection (ECalBackendCalDAV *cbdav,
 		    response == E_TRUST_PROMPT_RESPONSE_ACCEPT_TEMPORARILY) {
 			g_object_set (cbdav->priv->session, SOUP_SESSION_SSL_STRICT, FALSE, NULL);
 			soup_session_send_message (cbdav->priv->session, msg);
+
+			if (SOUP_STATUS_IS_SUCCESSFUL (msg->status_code) &&
+			    !e_source_webdav_ssl_trust_matches (extension, msg))
+				soup_message_set_status (msg, SOUP_STATUS_SSL_FAILED);
+			else
+				break;
+		} else {
+			break;
 		}
 	}
 
+	if (msg->status_code == SOUP_STATUS_SSL_FAILED)
+		g_object_set (cbdav->priv->session, SOUP_SESSION_SSL_STRICT, TRUE, NULL);
+
 	if (new_location) {
 		gchar *new_loc = soup_uri_to_string (soup_message_get_uri (msg), FALSE);
 
diff --git a/calendar/backends/http/e-cal-backend-http.c b/calendar/backends/http/e-cal-backend-http.c
index 1765dc2..e05d513 100644
--- a/calendar/backends/http/e-cal-backend-http.c
+++ b/calendar/backends/http/e-cal-backend-http.c
@@ -490,7 +490,7 @@ cal_backend_http_load (ECalBackendHttp *backend,
 	}
 
 	status_code = soup_session_send_message (soup_session, soup_message);
-	if (status_code == SOUP_STATUS_SSL_FAILED) {
+	while (status_code == SOUP_STATUS_SSL_FAILED) {
 		ESource *source;
 		ESourceWebdav *extension;
 		ESourceRegistry *registry;
@@ -518,9 +518,22 @@ cal_backend_http_load (ECalBackendHttp *backend,
 		    response == E_TRUST_PROMPT_RESPONSE_ACCEPT_TEMPORARILY) {
 			g_object_set (soup_session, SOUP_SESSION_SSL_STRICT, FALSE, NULL);
 			status_code = soup_session_send_message (soup_session, soup_message);
+
+			if (SOUP_STATUS_IS_SUCCESSFUL (status_code) &&
+			    !e_source_webdav_ssl_trust_matches (extension, soup_message)) {
+				status_code = SOUP_STATUS_SSL_FAILED;
+				soup_message_set_status (soup_message, status_code);
+			} else {
+				break;
+			}
+		} else {
+			break;
 		}
 	}
 
+	if (status_code == SOUP_STATUS_SSL_FAILED)
+		g_object_set (soup_session, SOUP_SESSION_SSL_STRICT, TRUE, NULL);
+
 	if (G_IS_CANCELLABLE (cancellable))
 		g_cancellable_disconnect (cancellable, cancel_id);
 
diff --git a/libedataserver/e-source-webdav.c b/libedataserver/e-source-webdav.c
index 26e9729..a67e100 100644
--- a/libedataserver/e-source-webdav.c
+++ b/libedataserver/e-source-webdav.c
@@ -1693,6 +1693,77 @@ e_source_webdav_store_ssl_trust_prompt (ESourceWebdav *extension,
 }
 
 /**
+ * e_source_webdav_ssl_trust_matches:
+ * @extension: an #ESourceWebdav
+ * @message: a #SoupMessage with set https certificate
+ *
+ * Compares stored SSL trust with the one set on a @message and returns
+ * whether they match. If either part doesn't have necessary information,
+ * or either the certificate hash or used @message<!-- -->'s URI host name
+ * is different, then returns FALSE.
+ *
+ * Returns whether certificate trust saved on @extension matches certificate
+ * and host name from @message.
+ *
+ * Since: 3.10
+ **/
+gboolean
+e_source_webdav_ssl_trust_matches (ESourceWebdav *extension,
+				   SoupMessage *message)
+{
+	GTlsCertificate *cert = NULL;
+	gchar *stored_host = NULL, *stored_hash = NULL;
+	GByteArray *bytes = NULL;
+	SoupURI *soup_uri;
+	const gchar *host;
+	gchar *hash;
+	gboolean matches;
+
+	g_return_val_if_fail (E_IS_SOURCE_WEBDAV (extension), FALSE);
+	g_return_val_if_fail (SOUP_IS_MESSAGE (message), FALSE);
+
+	if (!decode_ssl_trust (extension, NULL, &stored_host, &stored_hash))
+		return !soup_message_get_https_status (message, &cert, NULL) || !cert;
+
+	if (!soup_message_get_https_status (message, &cert, NULL) || !cert) {
+		g_free (stored_host);
+		g_free (stored_hash);
+
+		return FALSE;
+	}
+
+	soup_uri = soup_message_get_uri (message);
+	if (!soup_uri || !soup_uri_get_host (soup_uri)) {
+		g_free (stored_host);
+		g_free (stored_hash);
+
+		return FALSE;
+	}
+
+	g_object_get (cert, "certificate", &bytes, NULL);
+
+	if (!bytes) {
+		g_free (stored_host);
+		g_free (stored_hash);
+
+		return FALSE;
+	}
+
+	host = soup_uri_get_host (soup_uri);
+	hash = g_compute_checksum_for_data (G_CHECKSUM_SHA1, bytes->data, bytes->len);
+
+	matches = host && stored_host && g_ascii_strcasecmp (host, stored_host) == 0 &&
+		  hash && stored_hash && g_ascii_strcasecmp (hash, stored_hash) == 0;
+
+	g_byte_array_unref (bytes);
+	g_free (stored_host);
+	g_free (stored_hash);
+	g_free (hash);
+
+	return matches;
+}
+
+/**
  * e_source_webdav_unset_temporary_ssl_trust:
  * @extension: an #ESourceWebdav
  *
diff --git a/libedataserver/e-source-webdav.h b/libedataserver/e-source-webdav.h
index d6a4957..cf60f99 100644
--- a/libedataserver/e-source-webdav.h
+++ b/libedataserver/e-source-webdav.h
@@ -145,6 +145,9 @@ void		e_source_webdav_store_ssl_trust_prompt
 						(ESourceWebdav *extension,
 						 SoupMessage *message,
 						 ETrustPromptResponse response);
+gboolean	e_source_webdav_ssl_trust_matches
+						(ESourceWebdav *extension,
+						 SoupMessage *message);
 void		e_source_webdav_unset_temporary_ssl_trust
 						(ESourceWebdav *extension);
 
diff --git a/modules/owncloud-backend/owncloud-utils.c b/modules/owncloud-backend/owncloud-utils.c
index d6abe13..9cb5edc 100644
--- a/modules/owncloud-backend/owncloud-utils.c
+++ b/modules/owncloud-backend/owncloud-utils.c
@@ -574,7 +574,9 @@ find_sources (ECollectionBackend *collection,
 		msg, "application/xml; charset=utf-8",
 		SOUP_MEMORY_STATIC, req_body, strlen (req_body));
 
-	if (soup_session_send_message (session, msg) == SOUP_STATUS_SSL_FAILED) {
+	soup_session_send_message (session, msg);
+
+	while (msg->status_code == SOUP_STATUS_SSL_FAILED) {
 		ETrustPromptResponse response;
 		ENamedParameters *parameters;
 		ESourceWebdav *extension;
@@ -597,11 +599,21 @@ find_sources (ECollectionBackend *collection,
 		if (response == E_TRUST_PROMPT_RESPONSE_ACCEPT ||
 		    response == E_TRUST_PROMPT_RESPONSE_ACCEPT_TEMPORARILY) {
 			g_object_set (session, SOUP_SESSION_SSL_STRICT, FALSE, NULL);
-
 			soup_session_send_message (session, msg);
+
+			if (SOUP_STATUS_IS_SUCCESSFUL (msg->status_code) &&
+			    !e_source_webdav_ssl_trust_matches (extension, msg))
+				soup_message_set_status (msg, SOUP_STATUS_SSL_FAILED);
+			else
+				break;
+		} else {
+			break;
 		}
 	}
 
+	if (msg->status_code == SOUP_STATUS_SSL_FAILED)
+		g_object_set (session, SOUP_SESSION_SSL_STRICT, TRUE, NULL);
+
 	if (msg->status_code == SOUP_STATUS_MULTI_STATUS &&
 	    msg->response_body && msg->response_body->length) {
 		SoupURI *suri = soup_message_get_uri (msg);
