You don't want to be on the PDF — you should always save from the article page when possible.
If you're getting a red X for the PDF when saving from the article page, we'd want to see a Debug ID from Zotero (not the Zotero Connector) for the save attempt.
www-tandfonline-com.ezproxy.lib.uconn.edu:443 uses an invalid security certificate.
The certificate is not trusted because the issuer certificate is unknown. The server might not be sending the appropriate intermediate certificates. An additional root certificate may need to be imported.
Yeah, your university's proxy server is misconfigured. Your IT department will need to fix this. You can point them to the bottom section on this page for an explanation of the problem:
I am having a VERY hard time getting Zotero and the Chrome Zotero connector to work. Same issue with the article information loading (and a "snapshot"), but getting the big red X for the PDF. I have been troubleshooting with my university's librarian and tried everything, wasting so much time. I've reset the cache, turned off all Zotero add-ons & all Chrome extensions, tried on Firefox, tried on another computer, tested these 2 articles a hundred times by now (from Sage & Wiley). What was notable was the articles worked when I was on campus, but not when I am off campus. (other articles from different publishers also don't work, I just keep retesting the same 2 in order to diagnose this issue). Debug output- D419652211. https://journals-sagepub-com.ezproxy.lib.uconn.edu/doi/full/10.1177/1098214017699275 https://onlinelibrary-wiley-com.ezproxy.lib.uconn.edu/doi/full/10.1002/ev.20082
I think it must be something with the proxy settings and I have shared this with them. They don't think it is and won't let me talk to IT, and I'm just redirected back to the librarian. She continues to have me turn things off or post on this forum to get your help (but she said that she thinks you'll just say it is the proxy issue, which she doesn't think it is). I did share the link provided here (https://www.zotero.org/support/kb/incomplete_cert_chain). I also just ran one of the articles that didn't work through the SSL server test & it does seem to be related to a missing intermediate certificate and here is that diagnosis: https://www.ssllabs.com/ssltest/analyze.html?d=journals-sagepub-com.ezproxy.lib.uconn.edu. As they don't seem to believe me, can you verify (again) what you think the issue is?
If it is helpful, I'm sharing that she also had me turn off the proxy redirect settings in the Connector and instead in the app had me use a library link under advanced settings. Here is the breakdown:
Zotero Preferences, Advanced, Under "OpenURL," in the "Resolver:" box: https://webservices.lib.uconn.edu/redirect/ "Configure Our "Library Links" in Preferences. Zotero offers a Lookup tool to help you get to the full-text of articles for which you have only a citation in Zotero. Located near the top right of the Zotero client, it looks like a green arrow pointing to the right. The lookup drop-down menu includes Google Scholar and CrossRef by default, but you can add our library's full-text linking, too. This works just like the UCONN Full Text button in our library databases." https://guides.lib.uconn.edu/zotero/GetStarted
In Zotero Connector, uncheck Enable proxy redirection (she said: under "automatically redirect future requests" through our proxy server. Although it's counterintuitive, you don't want to do that!" https://guides.lib.uconn.edu/zotero/AddReferences
I have no idea why they are recommending turning off auto proxy redirection, which is one of Zotero's most convenient features. It also helps with getting the PDF reliably.
Beyond that, dstillman can confirm that again, but Zotero won't connect, i.e. download PDFs, through a broken SSL chain, so that really is the problem, yes. And since that's a problem in UConn's ezproxy Setup, it makes sense that things work for you on campus. Best advice I'd have is to find out who manages ezproxy at UConn and email them directly, leading not with Zotero but with the ssl analyzer
@amandasutter: Yes, you should point them to the Incomplete Cert Chain page and the SSL Labs result ("This server's certificate chain is incomplete.") and ask them to fix their broken server.
Hello, I am following up as the same issue persists at my university and they can't fix it. We had a VPN workaround for a while but that has ended. The library IT doesn't know how to fix the security issue despite me providing all your evidence and tips, and the university IT says it is a library issue. I'm in purgatory there so need to try to fix it another way.
I don't have a WebDAV server, so looking at the second bullet, I ran the command prompt provided: certutil -A -d $ZOTERO_PROFILE_PATH -n $CA_NICKNAME -t C -i $CA_CERT_FILE
But it yielded this: CertUtil: Unknown arg: -A
I ran certutil -? and none of the commands are single letters (A, D, etc). Can you provide help with another command? Perhaps this? -addstore -- Add certificate to store
I had also tried the steps to copy the cert9.db, key4.db, and pkcs11.txt files from the Firefox profile directory to the Zotero profile directory, but that didn't do anything.
I wish I could say that was the case, but it didn't work for me earlier today and I've been emailing IT all day with them telling me that they don't "control" this and that because it is an issue at other universities, it isn't something they should deal with (i.e., its Zotero's fault, not theirs). I spent weeks troubleshooting in the fall to no avail. In any case, it seems to work at the moment and I hope it continues...
Yes, they didn't fix it. As you can see, it still says "Chain Issues: Incomplete" on the SSL Labs test for the proxy server and caps the grade.
To be clear, a local fix here is not appropriate — anyone else at your university will have the same problem — but most likely you just copied over the files from a Firefox installation that had already been served the intermediate certificate from another site. As explained on the Incomplete Cert Chain, if another site serves the certificate properly, Firefox and Zotero will cache it. But it would still be broken in a new Firefox or Zotero profile, because the proxy server isn't serving it as it should be.
Oh I'm aware and I've said that to them repeatedly. But as of now, they think I'm an isolated case. Maybe not many people use Zotero, or seems Mac users have different functionality with the beta Zotero/Safari, or the VPN workaround worked in the past, but I'm sure more will have the problem in the future.
Beta wouldn't be different. Using a VPN rather than the web-based proxy would avoid the problem, yes. Simply using Zotero for a bit on other sites, not via this proxy, would also likely fix the problem — there are a finite number of intermediate certificates, and once any (properly configured) site serves this one, Zotero would have a copy of it and would no longer return this error.
Upgrade Storage
Errors with the connector grabbing the articles here:
https://journals-sagepub-com.ezproxy.lib.uconn.edu/doi/pdf/10.1177/1098214010369170
https://journals-sagepub-com.ezproxy.lib.uconn.edu/doi/pdf/10.1177/1098214020910265
https://onlinelibrary-wiley-com.ezproxy.lib.uconn.edu/doi/pdfdirect/10.1002/ev.20153
(Also, please start new threads for new issues — the thread you posted to was from 2018. I've moved this to a new thread.)
If you're getting a red X for the PDF when saving from the article page, we'd want to see a Debug ID from Zotero (not the Zotero Connector) for the save attempt.
https://www-tandfonline-com.ezproxy.lib.uconn.edu/doi/full/10.1080/09500690701731121
https://www.zotero.org/support/kb/incomplete_cert_chain
https://journals-sagepub-com.ezproxy.lib.uconn.edu/doi/full/10.1177/1098214017699275
https://onlinelibrary-wiley-com.ezproxy.lib.uconn.edu/doi/full/10.1002/ev.20082
I think it must be something with the proxy settings and I have shared this with them. They don't think it is and won't let me talk to IT, and I'm just redirected back to the librarian. She continues to have me turn things off or post on this forum to get your help (but she said that she thinks you'll just say it is the proxy issue, which she doesn't think it is). I did share the link provided here (https://www.zotero.org/support/kb/incomplete_cert_chain). I also just ran one of the articles that didn't work through the SSL server test & it does seem to be related to a missing intermediate certificate and here is that diagnosis: https://www.ssllabs.com/ssltest/analyze.html?d=journals-sagepub-com.ezproxy.lib.uconn.edu. As they don't seem to believe me, can you verify (again) what you think the issue is?
If it is helpful, I'm sharing that she also had me turn off the proxy redirect settings in the Connector and instead in the app had me use a library link under advanced settings. Here is the breakdown:
Zotero Preferences, Advanced, Under "OpenURL," in the "Resolver:" box:
https://webservices.lib.uconn.edu/redirect/
"Configure Our "Library Links" in Preferences. Zotero offers a Lookup tool to help you get to the full-text of articles for which you have only a citation in Zotero. Located near the top right of the Zotero client, it looks like a green arrow pointing to the right. The lookup drop-down menu includes Google Scholar and CrossRef by default, but you can add our library's full-text linking, too. This works just like the UCONN Full Text button in our library databases."
https://guides.lib.uconn.edu/zotero/GetStarted
In Zotero Connector, uncheck Enable proxy redirection (she said: under "automatically redirect future requests" through our proxy server. Although it's counterintuitive, you don't want to do that!" https://guides.lib.uconn.edu/zotero/AddReferences
Please help!
Beyond that, dstillman can confirm that again, but Zotero won't connect, i.e. download PDFs, through a broken SSL chain, so that really is the problem, yes. And since that's a problem in UConn's ezproxy Setup, it makes sense that things work for you on campus. Best advice I'd have is to find out who manages ezproxy at UConn and email them directly, leading not with Zotero but with the ssl analyzer
So I would like to do the security override described here but need a little help: https://www.zotero.org/support/kb/cert_override
I don't have a WebDAV server, so looking at the second bullet, I ran the command prompt provided: certutil -A -d $ZOTERO_PROFILE_PATH -n $CA_NICKNAME -t C -i $CA_CERT_FILE
But it yielded this: CertUtil: Unknown arg: -A
I ran certutil -? and none of the commands are single letters (A, D, etc). Can you provide help with another command? Perhaps this?
-addstore -- Add certificate to store
I had also tried the steps to copy the cert9.db, key4.db, and pkcs11.txt files from the Firefox profile directory to the Zotero profile directory, but that didn't do anything.
To be clear, a local fix here is not appropriate — anyone else at your university will have the same problem — but most likely you just copied over the files from a Firefox installation that had already been served the intermediate certificate from another site. As explained on the Incomplete Cert Chain, if another site serves the certificate properly, Firefox and Zotero will cache it. But it would still be broken in a new Firefox or Zotero profile, because the proxy server isn't serving it as it should be.