diff --git a/modules/cal-config-caldav/e-caldav-chooser.c b/modules/cal-config-caldav/e-caldav-chooser.c
index c0a96ec..31ba2f9 100644
--- a/modules/cal-config-caldav/e-caldav-chooser.c
+++ b/modules/cal-config-caldav/e-caldav-chooser.c
@@ -343,16 +343,16 @@ caldav_chooser_authenticate_cb (SoupSession *session,
                                 ECaldavChooser *chooser)
 {
 	ESource *source;
-	ESourceAuthentication *extension;
-	const gchar *extension_name;
+	ESourceAuthentication *auth_extension;
+	ESourceWebdav *webdav_extension;
 	const gchar *username;
 	const gchar *password;
 
 	source = e_caldav_chooser_get_source (chooser);
-	extension_name = E_SOURCE_EXTENSION_AUTHENTICATION;
-	extension = e_source_get_extension (source, extension_name);
+	auth_extension = e_source_get_extension (source, E_SOURCE_EXTENSION_AUTHENTICATION);
+	webdav_extension = e_source_get_extension (source, E_SOURCE_EXTENSION_WEBDAV_BACKEND);
 
-	username = e_source_authentication_get_user (extension);
+	username = e_source_authentication_get_user (auth_extension);
 	password = chooser->priv->password;
 
 	/* If our password was rejected, let the operation fail. */
@@ -367,6 +367,11 @@ caldav_chooser_authenticate_cb (SoupSession *session,
 	if (password == NULL || *password == '\0')
 		return;
 
+	if (!e_source_webdav_ssl_trust_matches (webdav_extension, message)) {
+		soup_message_set_status (message, SOUP_STATUS_SSL_FAILED);
+		return;
+	}
+
 	soup_auth_authenticate (auth, username, password);
 }
 
@@ -1411,7 +1416,8 @@ caldav_chooser_try_password_sync (ESourceAuthenticator *auth,
 	g_object_set (session, SOUP_SESSION_SSL_STRICT, TRUE, NULL);
 	g_object_set (chooser->priv->session, SOUP_SESSION_SSL_STRICT, TRUE, NULL);
 
-	if (soup_session_send_message (session, message) == SOUP_STATUS_SSL_FAILED) {
+	soup_session_send_message (session, message);
+	while (message->status_code == SOUP_STATUS_SSL_FAILED) {
 		ETrustPromptResponse response;
 		ENamedParameters *parameters;
 
@@ -1431,9 +1437,20 @@ caldav_chooser_try_password_sync (ESourceAuthenticator *auth,
 			g_object_set (session, SOUP_SESSION_SSL_STRICT, FALSE, NULL);
 			g_object_set (chooser->priv->session, SOUP_SESSION_SSL_STRICT, FALSE, NULL);
 			soup_session_send_message (session, message);
+
+			if (SOUP_STATUS_IS_SUCCESSFUL (message->status_code) &&
+			    !e_source_webdav_ssl_trust_matches (extension, message))
+				soup_message_set_status (message, SOUP_STATUS_SSL_FAILED);
+		} else {
+			break;
 		}
 	}
 
+	if (message->status_code == SOUP_STATUS_SSL_FAILED) {
+		g_object_set (session, SOUP_SESSION_SSL_STRICT, TRUE, NULL);
+		g_object_set (chooser->priv->session, SOUP_SESSION_SSL_STRICT, TRUE, NULL);
+	}
+
 	if (cancel_id > 0)
 		g_cancellable_disconnect (cancellable, cancel_id);
 
