When using HTTPS there is no way for a user to trust a certificate

Mark Birbeck's picture
Project:formsPlayer
Version:1.5.1
Component:Code
Category:feature
Priority:normal
Assigned:Unassigned
Status:active
Description

When IE is navigated to https://www.google.com/accounts/ClientLogin a dialog is usually shown to the user to ask them if they trust the HTTPS certificate. Answering 'yes' will allow the certificate to be used, and also remember this setting, at least for the duration of the session. However, if formsPlayer refers to this URL directly within a submission, no dialog is offered, and any form using this URL won't work until the certificate has been trusted.

The workaround is to navigate to the above URL before using any XForms that refer to that URL.

To test this, use the GData authentication sample; open the form and simply press 'Login', and since there is no user name and password this should give an error. If using Fiddler 2 and you only see a single CONNECT message which is not followed by a 403, then this indicates the certificate has not been trusted.

Updates

#1 submitted by Mark Birbeck on Mon, 2007-04-30 12:16

Although this is still an issue, it's not as common as first thought, and it shows itself mainly when working with Fiddler. All certificates will generate a warning when using Fiddler, because it is a proxy server, which makes it look like there is a domain conflict.