WebDAV files syncing using self-signed certificate (certificate override problem)

bpop

I was having issues trying to override self-signed certificate using this tutorial from the documentation: https://www.zotero.org/support/kb/cert_override

While it worked for the instance of Zotero installed on Linux, I couldn't get it to work on Windows 10. It kept popping the SEC_ERROR_UNKNOWN_ISSUER error.

It turned out that Firefox on Windows encodes a bit differently entries in the "PSM Certificate Override Settings file" than Firefox on Linux. Firefox on Linux added one additional letter after the third string in the line. When I added this letter to the cert_override.txt file on Windows, Zotero started to sync files via WebDAV.

Is it a known issue (I couldn't find any information about this)?

dstillman

Can you provide an example?

bpop

The cert_override.txt line with the entry of interest from Windows Firefox is:
xxx.xxx.xx.xx:443 OID.2.16... B8:... AAA...
while from the Linux Firefox it is:
xxx.xxx.xx.xx:443 OID.2.16... B8:... X AAA... (X before AAA...; everything else the same)

(colons after port numbers removed manually in both files).

The one from Linux works for both instances of Zotero -- Linux and Windows ones.

dstillman

Are you sure you don't just have different versions of Firefox on the two computers? It's possible a newer version of Firefox no longer adds that letter. There shouldn't be anything OS-specific here.

dstillman

I actually have a cert_override.txt in an old profile from 2015 that has that letter, and a newer file that doesn't, both from macOS. It's possible different versions of Firefox created different formats depending on when they first created the file.

Anyway, I'll add a note to the docs. This likely will stop being an issue in Zotero 7 beta anyway, so probably not worth spending time investigating. Thanks for the heads-up.

dstillman

Or, well, I guess it's probably pretty simple. Old versions of Firefox included the letter, which is why my old Firefox profile had it and why Zotero 6 expects it. Some recent version of Firefox must have stopped including the letter, which breaks the file for Zotero 6. I'd guess that you just have an older version of Firefox on Linux.

dstillman

And for reference, here's an archived page documenting that "override type" field:

https://udn.realityripple.com/docs/Archive/Misc_top_level/Cert_override.txt

For a self-signed cert, it should be U.

bpop

On Linux: 91.12.0esr
On Windows: 115.0.3

dstillman

Right.