diff --git a/addressbook/backends/webdav/e-book-backend-webdav.c b/addressbook/backends/webdav/e-book-backend-webdav.c
index 2cdae05..d76b948 100644
--- a/addressbook/backends/webdav/e-book-backend-webdav.c
+++ b/addressbook/backends/webdav/e-book-backend-webdav.c
@@ -229,7 +229,7 @@ send_and_handle_ssl (EBookBackendWebdav *webdav,
 	guint status_code;
 
 	status_code = soup_session_send_message (webdav->priv->session, message);
-	if (status_code == SOUP_STATUS_SSL_FAILED) {
+	while (status_code == SOUP_STATUS_SSL_FAILED) {
 		ESource *source;
 		ESourceWebdav *extension;
 		ESourceRegistry *registry;
@@ -257,9 +257,20 @@ send_and_handle_ssl (EBookBackendWebdav *webdav,
 		    response == E_TRUST_PROMPT_RESPONSE_ACCEPT_TEMPORARILY) {
 			g_object_set (webdav->priv->session, SOUP_SESSION_SSL_STRICT, FALSE, NULL);
 			status_code = soup_session_send_message (webdav->priv->session, message);
+
+			if (SOUP_STATUS_IS_SUCCESSFUL (status_code) &&
+			    !e_source_webdav_ssl_trust_matches (extension, message)) {
+				status_code = SOUP_STATUS_SSL_FAILED;
+				soup_message_set_status (message, status_code);
+			}
+		} else {
+			break;
 		}
 	}
 
+	if (status_code == SOUP_STATUS_SSL_FAILED)
+		g_object_set (webdav->priv->session, SOUP_SESSION_SSL_STRICT, TRUE, NULL);
+
 	return status_code;
 }
 
@@ -1136,10 +1147,20 @@ soup_authenticate (SoupSession *session,
 {
 	EBookBackendWebdav        *webdav = data;
 	EBookBackendWebdavPrivate *priv = webdav->priv;
+	ESourceWebdav *webdav_extension;
+	ESource *source;
 
 	if (retrying)
 		return;
 
+	source = e_backend_get_source (E_BACKEND (data));
+	webdav_extension = e_source_get_extension (source, E_SOURCE_EXTENSION_WEBDAV_BACKEND);
+
+	if (!e_source_webdav_ssl_trust_matches (webdav_extension, message)) {
+		soup_message_set_status (message, SOUP_STATUS_SSL_FAILED);
+		return;
+	}
+
 	if (priv->username != NULL) {
 		soup_auth_authenticate (auth, priv->username, priv->password);
 	}
diff --git a/calendar/backends/caldav/e-cal-backend-caldav.c b/calendar/backends/caldav/e-cal-backend-caldav.c
index f0f84b8..37b3fb5 100644
--- a/calendar/backends/caldav/e-cal-backend-caldav.c
+++ b/calendar/backends/caldav/e-cal-backend-caldav.c
@@ -1023,20 +1023,25 @@ soup_authenticate (SoupSession *session,
 {
 	ECalBackendCalDAV *cbdav;
 	ESourceAuthentication *auth_extension;
+	ESourceWebdav *webdav_extension;
 	ESource *source;
-	const gchar *extension_name;
 
 	cbdav = E_CAL_BACKEND_CALDAV (data);
 
 	source = e_backend_get_source (E_BACKEND (data));
-	extension_name = E_SOURCE_EXTENSION_AUTHENTICATION;
-	auth_extension = e_source_get_extension (source, extension_name);
+	auth_extension = e_source_get_extension (source, E_SOURCE_EXTENSION_AUTHENTICATION);
+	webdav_extension = e_source_get_extension (source, E_SOURCE_EXTENSION_WEBDAV_BACKEND);
 
 	if (retrying || cbdav->priv->force_ask_password) {
 		cbdav->priv->force_ask_password = TRUE;
 		return;
 	}
 
+	if (!e_source_webdav_ssl_trust_matches (webdav_extension, msg)) {
+		soup_message_set_status (msg, SOUP_STATUS_SSL_FAILED);
+		return;
+	}
+
 	if (E_IS_SOUP_AUTH_BEARER (auth)) {
 		soup_authenticate_bearer (session, msg, auth, cbdav);
 
@@ -1108,7 +1113,7 @@ send_and_handle_redirection (ECalBackendCalDAV *cbdav,
 	soup_message_headers_append (msg->request_headers, "Connection", "close");
 	soup_session_send_message (cbdav->priv->session, msg);
 
-	if (msg->status_code == SOUP_STATUS_SSL_FAILED) {
+	while (msg->status_code == SOUP_STATUS_SSL_FAILED) {
 		ESource *source;
 		ESourceWebdav *extension;
 		ESourceRegistry *registry;
@@ -1136,9 +1141,18 @@ send_and_handle_redirection (ECalBackendCalDAV *cbdav,
 		    response == E_TRUST_PROMPT_RESPONSE_ACCEPT_TEMPORARILY) {
 			g_object_set (cbdav->priv->session, SOUP_SESSION_SSL_STRICT, FALSE, NULL);
 			soup_session_send_message (cbdav->priv->session, msg);
+
+			if (SOUP_STATUS_IS_SUCCESSFUL (msg->status_code) &&
+			    !e_source_webdav_ssl_trust_matches (extension, msg))
+				soup_message_set_status (msg, SOUP_STATUS_SSL_FAILED);
+		} else {
+			break;
 		}
 	}
 
+	if (msg->status_code == SOUP_STATUS_SSL_FAILED)
+		g_object_set (cbdav->priv->session, SOUP_SESSION_SSL_STRICT, TRUE, NULL);
+
 	if (new_location) {
 		gchar *new_loc = soup_uri_to_string (soup_message_get_uri (msg), FALSE);
 
diff --git a/calendar/backends/http/e-cal-backend-http.c b/calendar/backends/http/e-cal-backend-http.c
index 13e4abd..023c20c 100644
--- a/calendar/backends/http/e-cal-backend-http.c
+++ b/calendar/backends/http/e-cal-backend-http.c
@@ -89,14 +89,19 @@ soup_authenticate (SoupSession *session,
 {
 	ECalBackendHttp *cbhttp;
 	ESourceAuthentication *auth_extension;
+	ESourceWebdav *webdav_extension;
 	ESource *source;
-	const gchar *extension_name;
 
 	cbhttp = E_CAL_BACKEND_HTTP (data);
 
 	source = e_backend_get_source (E_BACKEND (data));
-	extension_name = E_SOURCE_EXTENSION_AUTHENTICATION;
-	auth_extension = e_source_get_extension (source, extension_name);
+	auth_extension = e_source_get_extension (source, E_SOURCE_EXTENSION_AUTHENTICATION);
+	webdav_extension = e_source_get_extension (source, E_SOURCE_EXTENSION_WEBDAV_BACKEND);
+
+	if (!e_source_webdav_ssl_trust_matches (webdav_extension, msg)) {
+		soup_message_set_status (msg, SOUP_STATUS_SSL_FAILED);
+		return;
+	}
 
 	if (!retrying && cbhttp->priv->password != NULL) {
 		gchar *user;
@@ -498,7 +503,7 @@ cal_backend_http_load (ECalBackendHttp *backend,
 	}
 
 	status_code = soup_session_send_message (soup_session, soup_message);
-	if (status_code == SOUP_STATUS_SSL_FAILED) {
+	while (status_code == SOUP_STATUS_SSL_FAILED) {
 		ESource *source;
 		ESourceWebdav *extension;
 		ESourceRegistry *registry;
@@ -526,9 +531,20 @@ cal_backend_http_load (ECalBackendHttp *backend,
 		    response == E_TRUST_PROMPT_RESPONSE_ACCEPT_TEMPORARILY) {
 			g_object_set (soup_session, SOUP_SESSION_SSL_STRICT, FALSE, NULL);
 			status_code = soup_session_send_message (soup_session, soup_message);
+
+			if (SOUP_STATUS_IS_SUCCESSFUL (status_code) &&
+			    !e_source_webdav_ssl_trust_matches (extension, soup_message)) {
+				status_code = SOUP_STATUS_SSL_FAILED;
+				soup_message_set_status (soup_message, status_code);
+			}
+		} else {
+			break;
 		}
 	}
 
+	if (status_code == SOUP_STATUS_SSL_FAILED)
+		g_object_set (soup_session, SOUP_SESSION_SSL_STRICT, TRUE, NULL);
+
 	if (G_IS_CANCELLABLE (cancellable))
 		g_cancellable_disconnect (cancellable, cancel_id);
 
diff --git a/libedataserver/e-source-webdav.c b/libedataserver/e-source-webdav.c
index 6cff83c..a22c509 100644
--- a/libedataserver/e-source-webdav.c
+++ b/libedataserver/e-source-webdav.c
@@ -1679,6 +1679,82 @@ e_source_webdav_store_ssl_trust_prompt (ESourceWebdav *extension,
 }
 
 /**
+ * e_source_webdav_ssl_trust_matches:
+ * @extension: an #ESourceWebdav
+ * @message: a #SoupMessage with set https certificate
+ *
+ * Compares stored SSL trust with the one set on a @message and returns
+ * whether they match. If either part doesn't have necessary information,
+ * or either the certificate hash or used @message<!-- -->'s URI host name
+ * is different, then returns FALSE. The function returns %TRUE also in case
+ * the @message<!-- -->'s certificate has no errors, even if it doesn't match
+ * stored trust on @extension (if any).
+ *
+ * Returns whether certificate trust saved on @extension matches certificate
+ * and host name from @message.
+ *
+ * Since: 3.14
+ **/
+gboolean
+e_source_webdav_ssl_trust_matches (ESourceWebdav *extension,
+				   SoupMessage *message)
+{
+	GTlsCertificate *cert = NULL;
+	GTlsCertificateFlags cert_errors = 0;
+	gchar *stored_host = NULL, *stored_hash = NULL;
+	GByteArray *bytes = NULL;
+	SoupURI *soup_uri;
+	const gchar *host;
+	gchar *hash;
+	gboolean matches;
+
+	g_return_val_if_fail (E_IS_SOURCE_WEBDAV (extension), FALSE);
+	g_return_val_if_fail (SOUP_IS_MESSAGE (message), FALSE);
+
+	if (!decode_ssl_trust (extension, NULL, &stored_host, &stored_hash)) {
+		/* It's OK, if the certificate has no issues */
+		return !soup_message_get_https_status (message, &cert, &cert_errors) || !cert || !cert_errors;
+	}
+
+	if (!soup_message_get_https_status (message, &cert, &cert_errors) || !cert || !cert_errors) {
+		g_free (stored_host);
+		g_free (stored_hash);
+
+		return !cert_errors;
+	}
+
+	soup_uri = soup_message_get_uri (message);
+	if (!soup_uri || !soup_uri_get_host (soup_uri)) {
+		g_free (stored_host);
+		g_free (stored_hash);
+
+		return FALSE;
+	}
+
+	g_object_get (cert, "certificate", &bytes, NULL);
+
+	if (!bytes) {
+		g_free (stored_host);
+		g_free (stored_hash);
+
+		return FALSE;
+	}
+
+	host = soup_uri_get_host (soup_uri);
+	hash = g_compute_checksum_for_data (G_CHECKSUM_SHA1, bytes->data, bytes->len);
+
+	matches = host && stored_host && g_ascii_strcasecmp (host, stored_host) == 0 &&
+		  hash && stored_hash && g_ascii_strcasecmp (hash, stored_hash) == 0;
+
+	g_byte_array_unref (bytes);
+	g_free (stored_host);
+	g_free (stored_hash);
+	g_free (hash);
+
+	return matches;
+}
+
+/**
  * e_source_webdav_unset_temporary_ssl_trust:
  * @extension: an #ESourceWebdav
  *
diff --git a/libedataserver/e-source-webdav.h b/libedataserver/e-source-webdav.h
index 9fc1aab..393070b 100644
--- a/libedataserver/e-source-webdav.h
+++ b/libedataserver/e-source-webdav.h
@@ -144,6 +144,9 @@ void		e_source_webdav_store_ssl_trust_prompt
 						(ESourceWebdav *extension,
 						 SoupMessage *message,
 						 ETrustPromptResponse response);
+gboolean	e_source_webdav_ssl_trust_matches
+						(ESourceWebdav *extension,
+						 SoupMessage *message);
 void		e_source_webdav_unset_temporary_ssl_trust
 						(ESourceWebdav *extension);
 
diff --git a/modules/owncloud-backend/owncloud-utils.c b/modules/owncloud-backend/owncloud-utils.c
index d89d1d2..1dd526b 100644
--- a/modules/owncloud-backend/owncloud-utils.c
+++ b/modules/owncloud-backend/owncloud-utils.c
@@ -432,16 +432,23 @@ authenticate_cb (SoupSession *session,
                  gpointer user_data)
 {
 	EOwncloudAuthenticator *authenticator = user_data;
+	ESourceWebdav *webdav_extension;
+	ESource *source;
 
 	g_return_if_fail (authenticator != NULL);
 
+	source = e_backend_get_source (E_BACKEND (authenticator->collection));
+	webdav_extension = e_source_get_extension (source, E_SOURCE_EXTENSION_WEBDAV_BACKEND);
+
+	if (!e_source_webdav_ssl_trust_matches (webdav_extension, msg)) {
+		soup_message_set_status (msg, SOUP_STATUS_SSL_FAILED);
+		return;
+	}
+
 	if (retrying || !authenticator->password) {
 		ESourceRegistryServer *server;
 		EAuthenticationSession *auth_session;
-		ESource *source;
 
-		source = e_backend_get_source (
-			E_BACKEND (authenticator->collection));
 		server = e_collection_backend_ref_server (
 			authenticator->collection);
 
@@ -565,7 +572,9 @@ find_sources (ECollectionBackend *collection,
 		msg, "application/xml; charset=utf-8",
 		SOUP_MEMORY_STATIC, req_body, strlen (req_body));
 
-	if (soup_session_send_message (session, msg) == SOUP_STATUS_SSL_FAILED) {
+	soup_session_send_message (session, msg);
+
+	while (msg->status_code == SOUP_STATUS_SSL_FAILED) {
 		ETrustPromptResponse response;
 		ENamedParameters *parameters;
 		ESourceWebdav *extension;
@@ -588,11 +597,19 @@ find_sources (ECollectionBackend *collection,
 		if (response == E_TRUST_PROMPT_RESPONSE_ACCEPT ||
 		    response == E_TRUST_PROMPT_RESPONSE_ACCEPT_TEMPORARILY) {
 			g_object_set (session, SOUP_SESSION_SSL_STRICT, FALSE, NULL);
-
 			soup_session_send_message (session, msg);
+
+			if (SOUP_STATUS_IS_SUCCESSFUL (msg->status_code) &&
+			    !e_source_webdav_ssl_trust_matches (extension, msg))
+				soup_message_set_status (msg, SOUP_STATUS_SSL_FAILED);
+		} else {
+			break;
 		}
 	}
 
+	if (msg->status_code == SOUP_STATUS_SSL_FAILED)
+		g_object_set (session, SOUP_SESSION_SSL_STRICT, TRUE, NULL);
+
 	if (msg->status_code == SOUP_STATUS_MULTI_STATUS &&
 	    msg->response_body && msg->response_body->length) {
 		SoupURI *suri = soup_message_get_uri (msg);
