Community-edition: Missing "Trust invalid authority certificates" option.

[orange-buffalo]

TC:

1. Setup HTTP server with invalid certificate (let's say it is self-signed certificate for local network service).
2. Place an image resource into the server.
3. Setup Outlook 365 account in Rambox.
4. Send and email to this account, in HTML format, add image tag referencing resource from step 2 with https protocol.
5. Open this email in Outlook 365 via Rambox.
   Error message appears:

The service with the following URL has an invalid authority certification.
<URL>
You have to remove the service and add it again, enabling the "Trust invalid authority certificates" in the Options.

But there is no such option in Add Outlook 365 dialog.

Rambox 0.4.1
Electron 1.3.1
linux x64 4.7.2-040702-generic

[saenzramiro]

Right, that option is only on the Custom Services.

What if you open that email in Outlook 365 in Chrome? Is showing a message/error/warning?

[orange-buffalo]

In Chrome everything is okay, image is displayed, no error messages, nothing related in js console.
Maybe I should also mention that I visited the server that provides the image before, in Chrome, and ignored the problem with this certificate.

[saenzramiro]

Are you sure you don't allow that certificate before?

[orange-buffalo]

You are right, I added this certificate to exceptions in Chrome previously.

[saenzramiro]

Can you remove the exception and tell me what Chromes do when wants to load the image?

[orange-buffalo]

When certificate is removed from exceptions in Chrome, image is not loaded and there is an error message in JS console:

Failed to load resource: net::ERR_INSECURE_RESPONSE

[saenzramiro]

So what we can do is to prevent showing the error message and just not displaying the image, like Chrome. Do you agree?

[orange-buffalo]

I believe this approach is good as a short-term solution.
But it will limit functionality of Rambox. In my opinion the best way to resolve this would be to provide configuration option either to ignore certificate errors or to add certificate to exceptions like Chrome does, resulting in ability to display images served by servers with self-signed certificates.

[88scythe]

I run into the same issue but not for images.

I'm using a Cisco soft-phone application, which communicates to an in-browser-app.
The latter is an internal thing with a self-signed certificate. I can access it in Chrome by adding the exception for the cert, but would like to add it as custom service in Rambox too.

[saenzramiro]

@88scythe Did you check the option for "Trust invalid certificate" when you add the Custom Service?

[88scythe]

Hi
I did. Only thing I get once I open the configured custom service is a blank page. No errors, no warnings, no nothing. :s

[saenzramiro]

What about opening in Chrome?

[rodneyrod]

@saenzramiro
I'm getting issues with other services with self signed certs not working.

I'm pretty sure the Trust Invalid Certificate option is no longer working

[sNiXx]

I have come across this issue for the first time since using Rambox. In my case todoist does not fully
load, stating "Certification Warning" in the status bar. Perhaps because of certificate issues with cloudfront.net? When I checked using the developer tools, it states in the "Security" tab that the certificate is valid. However, when I add the resolved URL (*.cloudfront.net) as a seperate service, it states in the "Security" tab the certificate is invalid.

I suspect this may have been caused by updating to 0.5.15. Using Chrome, todoist loads without any error.

[sNiXx]

Thanks for the quick fix!

[fvulich]

I'm gonna close this ticket because seems to be fixed