Thanks for a bug report. This error comes from glib-networking, when it fails to verify the certificate issuer. If you are able to import the certificate, and/or its issuer certificate to evolution in Edit->Preferences->Certificates->Authorities, and set a Trust to it for all three options, then you should be able to connect. You can do the same import and trust setting in a web browser, like Firefox, because the certificate database is shared.

Could you try that, please?

Hi,

I tried it and certificate was also in the evolution since I have already installed it in the system.

Hi,

maybe I should point out that I am behind Cisco Ironport. That firewall/proxy decrypts all ssl traffic to detect malicious code. In order to do that it performs some sort "man in the middle" attack.

To client it sends its own certificate. On the other side it establishes ssl connection to the server. It uses two ssl connections and it sits in the middle to check all the traffic. That is why I can not the right certificate from the server with the server name (common name) in the certificate that would match the server's name. I know it is stupid but I have no choice but to access my e-mail via this proxy.

(In reply to comment #3)
> To client it sends its own certificate.

Do you have access to that certificate, and can you import it and set trust on it either in a web browser (like FireFox) or in Evolution itself? I suppose
the Cisco certificate is self-signed, thus it's different from the one on the server you try to connect to (I know of comment #2, I only think those are two different certificates).

Strange is, that evolution-ews doesn't use the checking for certificate issuers, it doesn't enforce it. It makes me wonder, what is the libsoup and glib-networking version you use? (Maybe defaults in libsoup changed.)

I have the CA certificate. When I treid to import it into evolution it reported that the certificate is already in the store.

I have the default packages installed. I hev the ones that come with Ubuntu 12.10.

(In reply to comment #5)
> I have the default packages installed. I hev the ones that come with Ubuntu
> 12.10.

I'm sorry, but I do not know what Ubuntu 12.10 ships. If this works:
   $ rpm -q evolution-data-server evolution evolution-ews libsoup glib2 glib-networking

Well, Ubuntu uses deb packages and they don't match 1:1 to rpms.

I found this:

~$ dpkg-query -l evolution-data-server evolution evolution-ews gir1.2-soup-2.4 libsoup-gnome2.4-1 glib-networking
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name                                   Version                  Architecture             Description
+++-======================================-========================-========================-=================================================================================
ii  evolution                              3.6.2-0ubuntu0.1         amd64                    groupware suite with mail client and organizer
ii  evolution-data-server                  3.6.2-0ubuntu0.1         amd64                    evolution database backend server
ii  evolution-ews                          3.6.0-0ubuntu1           amd64                    Exchange Web Services integration for Evolution
ii  gir1.2-soup-2.4                        2.40.0-0ubuntu1          amd64                    GObject introspection data for the libsoup HTTP library
ii  glib-networking:amd64                  2.34.0-0ubuntu1          amd64                    network-related giomodules for GLib
ii  libsoup-gnome2.4-1:amd64               2.40.0-0ubuntu1          amd64                    HTTP library implementation in C -- GNOME support library

If you need more specific information about libraries. I can take a look if you let me know which ones.

Thanks for the update. I see the libsoup is not the latest (there is 2.40.3 release, which contains certain fixes related to evolution too), neither the evolution packages (current 3.6.x stable version is 3.6.4). I do not know about glib-networking, though.

Dan, do you know about anything in libsoup and/or glib-networking which would make the glib-networking to test server certificate even the evolution-ews code doesn't force strict-ssl, pleasE?

nothing has changed related to this in glib-networking or libsoup

(In reply to comment #5)
> I have the CA certificate. When I treid to import it into evolution it reported
> that the certificate is already in the store.

Maybe the man-in-the-middle certificate has the same name/id as one of the real CA certs? (Ugh.)

In fact I imported the CA certificate with which proxy and email website are signed. I did not import the certificates from each page.

(In reply to comment #10)
> In fact I imported the CA certificate with which proxy and email website are
> signed. I did not import the certificates from each page.

OK, and what about the trust, do you have set on the imported certificate trust for all three kinds? The connection is rejected without the trust.

(In reply to comment #11)
> (In reply to comment #10)
> > In fact I imported the CA certificate with which proxy and email website are
> > signed. I did not import the certificates from each page.
> 
> OK, and what about the trust, do you have set on the imported certificate trust
> for all three kinds? The connection is rejected without the trust.

I have set the trust for web pages (HTTPS). I have changed it now also to identify e-mail users and software developers. It did not help as I expected. I believe the first trust is the right one.

I have done a little more debugging.

Evolution automatically shows accounts set up in online-accounts. The only way to delete them from evolution is to delete an online-account.

Because I was not able to delete GMail account from evolution I misinterpreted evolutions behavior because GMail account was also checked. After I deleted GMail online-account from Ubuntu I monitored traffic with Wireshark. From these GMail communication I got the CA errors previously.

It seems like evolution-ews is ignoring proxy settings for HTTP and HTTPS protocols. In wireshark it is shown that evolution makes a connection directly to the outlook server. Then I connected the computer to a direct connection and evolution-ews worked with the outlook server although it was configured to use the proxy.

I believe HTTP and HTTPS proxies shall be used for evolution-ews because web services run over HTTP and/or HTTPS.

Ah, I see, you are right, evolution-ews doesn't use Proxy settings at all.

Created attachment 243974 [details] [review]
proposed ews patch

for evolution-ews;

This adds proxy usage (if required by the setup) to evolution-ews.
Are you able to test this, please? It uses proxy settings from Evolution (Edit->Preferences->Network Preferences).

I can try, but it will take me some time.

When I fetched the latest evolution source I figured out that it won't compile because I don't have the newest libraries. So first task I need to do is to compile evolution and evolution-ews. I will try to get the same version I already have installed from binary packages and try to compile it. Then I will apply the patch.

The patch is for evolution-ews only, thus you can simply install devel packages for evolution, evolution-data-server, libsoup, glib, gtk3 and possibly couple more packages, and then build patches evolution-ews only from source packages. Building also evolution is not needed.

I would help you, like build a test package for you, but I do that for Fedora only, I do not know how Ubuntu does that. There is some command to download all build dependencies for the package on Ubuntu, which might help a bit.

Hi,

I managed to compile evolution. It took me some time. It did not work until I uninstalled the default evolution installation from deb packages. Until then I was never sure which plugins are loaded, etc.

Well the result now is that that I managed to enter ews account. BTW, because of the bug https://bugs.launchpad.net/ubuntu/+source/evolution-ews/+bug/1056942 I still had to make some manual tweaks to be able to add account.

The problem I have now is that evolution is constantly popping up a dialog window to enter password for my account. I am sure I entered the correct password many times but it reports "Password was incorrect.".

Hmm, did you build it half from the system (the evolution-data-server part) and half on your own (the evolution and evolution-ews part)? It' might be a strange mix. Anyway, run
   $ GCR_DEBUG=all /usr/libexec/evolution-source-registry
on one console (path can be different on your machine) and then:
   $ EWS_DEBUG=2 evolution
on another, then see what evolution does between passwords prompts. The source registry console will show the password prompts. The interesting part might be with the evolution console, because it also shows what the server returned, and what was sent.

Well it seems to be strange mix. I was not able to uninstall evolution-data-server because gnome-shell was dependent on it. Removing gnome-shell means to remove window manager for me. I installed another window manager and uninstalled evolution-data-server. There are still some packages from official distribution but they are more libraries and their sources.

evolution-data-server-common  all    architecture independent files for Evolution Data Server
evolution-data-server-dev     amd64  development library files for Evolution
libebackend-1.2-5             amd64  Utility library for evolution data servers
libebackend1.2-dev            amd64  Utility library for evolution data servers (development files)
libebook-1.2-14               amd64  Client library for evolution address books
libebook1.2-dev               amd64  Client library for evolution address books (development files)
libecal-1.2-15                amd64  Client library for evolution calendars
libecal1.2-dev                amd64  Client library for evolution calendars (development files)
libedata-book-1.2-15          amd64  Backend library for evolution address books
libedata-book1.2-dev          amd64  Backend library for evolution address books (development files)
libedata-cal-1.2-18           amd64  Backend library for evolution calendars
libedata-cal1.2-dev           amd64  Backend library for evolution calendars (development files)
libedataserver-1.2-17         amd64  Utility library for evolution data servers
libedataserver1.2-dev         amd64  Utility library for evolution data servers (development files)
libedataserverui-3.0-4        amd64  GUI utility library for evolution data servers
libedataserverui-3.0-dev      amd64  GUI utility library for evolution data servers (development files)
libevolution                  amd64  evolution libraries

Here is what I get from evolution-source-registry. I don't have to run evolution to get password prompt. It seems it is somehow integrated with desktop to pop up alarms for new e-mails. So I get prompt to enter password as soon as I log in.

Migrating mail accounts from GConf...
Migrating addressbook sources from GConf...
Migrating calendar sources from GConf...
Migrating task list sources from GConf...
Migrating memo list sources from GConf...
Registering EGoogleBackendFactory ('google')
Registering EEwsBackendFactory ('ews')
Registering EYahooBackendFactory ('yahoo')
Adding vfolder ('Source')
Adding local ('Source_1')
Adding 1368524297.17914.1@markoh-ThinkPad-T500 ('Source_2')
Adding 1368524298.17914.14@markoh-ThinkPad-T500 ('Source_3')
Adding 1368524297.17914.0@markoh-ThinkPad-T500 ('Source_4')
Adding 1368524297.17914.3@markoh-ThinkPad-T500 ('Source_5')
Adding weather-stub ('Source_6')
Adding caldav-stub ('Source_7')
Adding contacts-stub ('Source_8')
Adding webcal-stub ('Source_9')
Adding ldap-stub ('Source_10')
Adding google-stub ('Source_11')
Adding webdav-stub ('Source_12')
Adding local-stub ('Source_13')
Adding birthdays ('Source_14')
Adding system-task-list ('Source_15')
Adding system-memo-list ('Source_16')
Adding sendmail ('Source_17')
Adding system-calendar ('Source_18')
Adding system-address-book ('Source_19')
module-cache-reaper-Message: Scanning data directories
module-cache-reaper-Message: Scanning cache directories
Server is up and running...
marko.hrastovec@sloveniacontrol.si: Pairing 1368524633.18147.0@markoh-ThinkPad-T500 with resource global-address-list
Adding 1368524633.18147.0@markoh-ThinkPad-T500 ('Source_20')
Bus name 'org.gnome.evolution.dataserver.Sources0' acquired.
AUTH (1368524297.17914.1@markoh-ThinkPad-T500): Initiated
(process:22594): Gcr-DEBUG: gcr_system_prompt_open_for_prompter: opening prompt
(process:22594): Gcr-DEBUG: perform_init_async: connecting to bus
(process:22594): Gcr-DEBUG: on_bus_connected: connected to bus
(process:22594): Gcr-DEBUG: on_prompter_begin_prompting: registered prompt org.gnome.keyring.SystemPrompter: /org/gnome/keyring/Prompt/p0
(process:22594): Gcr-DEBUG: gcr_system_prompt_get_secret_exchange: creating new secret exchange
(process:22594): Gcr-DEBUG: gcr_secret_exchange_set_property: automatically selecting secret exchange protocol
(process:22594): Gcr-DEBUG: gcr_secret_exchange_receive: receiving secret exchange: [sx-aes-1]\npublic=kSl4yXzZ+xKuRfKhYvIfDXGiyeKaCYTcqW7iMIacfcrImDreS5c7f5doGJA03nO5MIWP1l6cWC7VlDIvpq9c59KB5kKgjWhvv2W2QHsHuBhJjLac/KXg52QNreZPxJ55/RB1LYyBh19zCfkf9na0fUftFzZ3I+HCXdtEazmYZLvgR+vVYQBBWsvLUjWFFVfe+LYjW01D2cdhyF5KEoXZgdZQxXW9/brYMWLrVJW9X8NKlrrmNfyltkEAEB25z0t0\n
(process:22594): Gcr-DEBUG: gcr_secret_exchange_default_generate_exchange_key: generating public key
(process:22594): Gcr-DEBUG: derive_key: deriving shared transport key
(process:22594): Gcr-DEBUG: gcr_secret_exchange_default_derive_transport_key: deriving transport key
(process:22594): Gcr-DEBUG: perform_prompt_async: prompting for password
(process:22594): Gcr-DEBUG: gcr_secret_exchange_send: sending the secret exchange: [sx-aes-1]\npublic=q6Y2K9L2iTANEgMtvXcdl9BlNIqrcB6sgmrTXTe7iSAQGsqg0MDziSxySPqTxTl9W5BQgq0pdmABYUxY/MBilVWgy51nvR173hP7lmGnFNKlp6HZqRbBQYGE9GUhNees0PFhpjMOw3x8sSLXh5NcHAED3nLNIiORNTYANgVIBRInYD3kcVQSoZouFh7ldfXt4WwrZ5ZpqfrNUFqtO7/Uql676Jzh6Y0OaKYhSnyz/DZeE0ehxOgadAW7bjgG1IyI\n
(process:22594): Gcr-DEBUG: gcr_secret_exchange_receive: receiving secret exchange: [sx-aes-1]\npublic=kSl4yXzZ+xKuRfKhYvIfDXGiyeKaCYTcqW7iMIacfcrImDreS5c7f5doGJA03nO5MIWP1l6cWC7VlDIvpq9c59KB5kKgjWhvv2W2QHsHuBhJjLac/KXg52QNreZPxJ55/RB1LYyBh19zCfkf9na0fUftFzZ3I+HCXdtEazmYZLvgR+vVYQBBWsvLUjWFFVfe+LYjW01D2cdhyF5KEoXZgdZQxXW9/brYMWLrVJW9X8NKlrrmNfyltkEAEB25z0t0\nsecret=UOymFQH1kxTgkulqg+ztDg==\niv=JOzwHRMOYruztf+UOmPYsg==\n
(process:22594): Gcr-DEBUG: gcr_secret_exchange_default_decrypt_transport_data: decrypting data
(process:22594): Gcr-DEBUG: perform_prompt_async: prompting for password
(process:22594): Gcr-DEBUG: gcr_secret_exchange_send: sending the secret exchange: [sx-aes-1]\npublic=q6Y2K9L2iTANEgMtvXcdl9BlNIqrcB6sgmrTXTe7iSAQGsqg0MDziSxySPqTxTl9W5BQgq0pdmABYUxY/MBilVWgy51nvR173hP7lmGnFNKlp6HZqRbBQYGE9GUhNees0PFhpjMOw3x8sSLXh5NcHAED3nLNIiORNTYANgVIBRInYD3kcVQSoZouFh7ldfXt4WwrZ5ZpqfrNUFqtO7/Uql676Jzh6Y0OaKYhSnyz/DZeE0ehxOgadAW7bjgG1IyI\n
(process:22594): Gcr-DEBUG: gcr_secret_exchange_receive: receiving secret exchange: [sx-aes-1]\npublic=kSl4yXzZ+xKuRfKhYvIfDXGiyeKaCYTcqW7iMIacfcrImDreS5c7f5doGJA03nO5MIWP1l6cWC7VlDIvpq9c59KB5kKgjWhvv2W2QHsHuBhJjLac/KXg52QNreZPxJ55/RB1LYyBh19zCfkf9na0fUftFzZ3I+HCXdtEazmYZLvgR+vVYQBBWsvLUjWFFVfe+LYjW01D2cdhyF5KEoXZgdZQxXW9/brYMWLrVJW9X8NKlrrmNfyltkEAEB25z0t0\n
(process:22594): Gcr-DEBUG: gcr_system_prompt_close_async: closing prompt
(process:22594): Gcr-DEBUG: gcr_system_prompt_dispose: closing prompt asynchronously: (null)
AUTH (1368524297.17914.1@markoh-ThinkPad-T500): Complete (DISMISSED)

(In reply to comment #20)
> Well it seems to be strange mix. I was not able to uninstall
> evolution-data-server because gnome-shell was dependent on it. Removing
> gnome-shell means to remove window manager for me. I installed another window
> manager and uninstalled evolution-data-server. There are still some packages
> from official distribution but they are more libraries and their sources.

Oh, that's really unfortunate. Installing -dev packages for libsoup and evolution should let you away from the dependency madness, and compile only patched evolution-ews.

> Here is what I get from evolution-source-registry.

aah, good. Could you also
  $ export EWS_DEBUG=2
before running the source registry, to get output from the EWS itself? There will be more lines printed between each password prompt. I would not paste it here, it'll contain private information, thus either attach it stripped from that info (server addresses and user names/emails), or feel free to send it only to me, only name the bug number in the subject, otherwise I might overlook it in my spam folder.

I sent you the debug info to private e-mail.

Thanks a lot. I see the things which libsoup does look differently, than without proxy, but I do not know why it does what it does. In any case, I found a proxy server which I can use for testing (I'm sorry, I should look for it at the very beginning), and I see the same. I believe the patch to evolution-ews is correct, there is only needed to patch also libsoup (on the first look). I'll consult this with Dan, a libsoup developer (I see he's already CC'ed).

I see the same with libsoup 2.42.2.

(In reply to comment #23)
> Thanks a lot. I see the things which libsoup does look differently, than
> without proxy, but I do not know why it does what it does. In any case, I found
> a proxy server which I can use for testing (I'm sorry, I should look for it at
> the very beginning), and I see the same. I believe the patch to evolution-ews
> is correct, there is only needed to patch also libsoup (on the first look).
> I'll consult this with Dan, a libsoup developer (I see he's already CC'ed).

I'm glad I could help a bit. I am looking forward to get a fix. Until I get this fix I can only use web mail.

The libsoup bug is now fixed in master. There's no easy workaround from the evolution side though...

Milan, were you planning to get this fix into earlier versions, or just master?

Please include it in earlier versions too. Otherwise it will take ages before the change will be distributed via regular binary packages.

Thanks Dan, the best if you could provide a patch (or a link to it) also for libsoup-2.40.3 and later. I guess Marko will be able to build also libsoup, when he builds eds and evo on his own (libsoup is way simpler than evo family).

Created attachment 244344 [details] [review]
patch against 2.40.3

I committed the evolution-ews part into sources:

Created commit 9400df7 in ews master (3.9.2+)
Created commit a3d4a72 in ews gnome-3-8 (3.8.3+)

Thanks Dan. Are you committing to master and gnome-3-8 as well? Just for a reference, what libsoup versions will contain this fix, please?

Yes, master and gnome-3-8. Of course, at this point there are no more 3.8 releases scheduled, but I ended up putting out a .3 last cycle, so I guess I can do that this cycle too. (Obviously it's too late for 3.8.2.)

Please do 3.8.3 release (we have scheduled 3.8.3 release for evolution
on Jun 10, you can join us, if you wish.

*** Bug 709411 has been marked as a duplicate of this bug. ***