webdav ssl certificate problem zotero standalone

igw

I'm trying to sync files via webdav in Zotero standalone, but I get an ssl certificate error. This is what the log says:

"The certificate is not trusted because no issuer chain was provided.
(Error code: sec_error_unknown_issuer)"

Zotero then asks me to follow the instructions on this page:
http://www.zotero.org/support/kb/cert_override

However, the curious thing is that Firefox accepts the certificate without problems (and syncing works). Thus, the certificate is not included in my "cert_override.txt" file. In fact, when I manually try to add an exception for the certificate in Firefox, it says that there would be no need to do that because the certificate was valid. On the other hand, if I open the link to the webdav-server on my ipad, Safari does not trust the certificate.

What am I doing wrong here?

dstillman

What about other other browsers on your computer?

What's the certificate hierarchy, if in Firefox you click the lock -> More Information -> View Certificate -> Details?

What version of Firefox?

igw

Google Chrome also works without adding an exception

The certificate hierarchy is

Deutsche Telekom Root CA 2
  DFN-Verein PCA Global - G01
    UniKoeln CA
      sofsdav.uni-koeln.de

I use Firefox 19.0.2

dstillman

Your WebDAV server isn't serving the necessary intermediate SSL certificates, and Firefox (and therefore Standalone) won't download them on its own. Chrome (and Safari) might do so.

If you can load https://sofsdav.uni-koeln.de in Firefox, it's likely because you previously loaded another site of your university's that included the intermediate certificate, which Firefox would cache. But, for example, I get sec_error_unknown_issuer loading that site in Firefox.

There's probably a way for you to get the intermediate certificate into Standalone, but really this is up to your WebDAV server admins to fix. All sites should serve their own intermediate certificates (which is the basis for Mozilla's policy here). So I'd recommend just talking to them.

igw

So apparently, it is an IIS server which can't be configured to deliver the intermediate certificate chain to normal clients (it seems to use a different method to handle this when communicating with special Windows/Microsoft clients).

The following trick (suggested by the server admin) solved the problem: I entered the address of another server using the same certificate chain that is not a webdav-server but that is serving the intermediate certificates. Of course, Zotero could not establish a webdav-connection with it but when it tried, it downloaded the intermediate certificates. Now, Zotero also connects to the webdav server.