<html><body><div style="font-family: times new roman, new york, times, serif; font-size: 12pt; color: #000000"><div>Hi Gianni<br></div><div><br></div><div>I agree that accepting the auto-signed certificate without prompt would be a potential security breach. </div><div><br></div><div>However, I think there should be a dialog automatically opened by the OS asking the user what to do (or at least delegate the dialog implementation to the app itself).<br></div><div><br></div><div>I am developping a sailfish app that is connected to an owncloud instance. Most of the time, the average geek (including me :) ) is using auto-signed ssl certificate. I don't want to force the user to use http where https could be used.<br></div><div><br></div><div>I don't know C++ so I'm not really ready to play with QNetwork. Maybe I'll find something on the internet...<br></div><div><br></div><div>Regards,<br></div><div><br></div><div>Antoine<br></div><div><br></div><div><span name="x"></span>--<br>Tigre-Bleu<br>mail/jabber: antoine.vacher@tigre-bleu.net<span name="x"></span><br></div><div><br></div><hr id="zwchr"><div style="color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;" data-mce-style="color: #000; font-weight: normal; font-style: normal; text-decoration: none; font-family: Helvetica,Arial,sans-serif; font-size: 12pt;"><b>De: </b>"Gianni Vialetto" <gianni@rootcube.net><br><b>À: </b>"Sailfish OS Developers" <devel@lists.sailfishos.org><br><b>Envoyé: </b>Samedi 9 Novembre 2013 12:25:54<br><b>Objet: </b>Re: [SailfishDevel] Ignoring auto signed SSL certificates<br><div><br></div><div dir="ltr">On Fri, Nov 8, 2013 at 7:26 PM, Tigre-Bleu <span dir="ltr"><<a href="mailto:devel@tigre-bleu.net" target="_blank" data-mce-href="mailto:devel@tigre-bleu.net">devel@tigre-bleu.net</a>></span>wrote:<div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex" data-mce-style="margin: 0 0 0 .8ex; border-left: 1px #ccc solid; padding-left: 1ex;">Hello,<br> <br> The open() function of XMLHttpRequest seems to not work with auto signed ssl certificates. I have checked with valid certificates and there is no problem.<br> <br> Is this the expected behavior? If so how am I supposed to fetch some data from an auto signed https page using QML?<br> <br> Thanks,<br> <br> Antoine<br></blockquote><div><br></div><div>Hi Antoine,<br><div><br></div>I cannot confirm it without diving into the implementation, but i believe the behavior of XHR you are seeing is reasonable from a security point of view - the alternative could be to prompt the user for confirmation. </div></div>As an alternative you could construct the connection with QNetwork classes from the C++ side (the QSslConfiguration class should have a method to add a new CA to the list of those accepted).<br><br clear="all"><div>Regards,</div>-- <br>Gianni Vialetto<br></div></div><br>_______________________________________________<br>SailfishOS.org Devel mailing list</div><div><br></div></div></body></html>