MozillaZine

Cannot get Lightning to connect with my Goole account

User Help for Mozilla Thunderbird
WV-Mike
 
Posts: 53
Joined: January 13th, 2008, 6:53 am

Post Posted February 28th, 2016, 8:02 am

I am trying to connect my Lightning calendar with my Gmail calendar.
Any time I try this I get a "Secure Connection Failed" error.

If I add an exemption it still will not connect.
I have no prior experience with Certificates, etc.


Here are screen shots
Image
Image

tanstaafl
Moderator

User avatar
 
Posts: 43257
Joined: July 30th, 2003, 5:06 pm

Post Posted February 28th, 2016, 11:25 am

Try going to https://accounts.google.com/ using Firefox and see if you get the same error. I get a SSL Client Certificate certificate issued by Google Internet Authority G2, which uses "GeoTrust Global CA" as the CA (use the details tab to see that). Typically you'd get the same certificate whether you use Firefox or Thunderbird. In Firefox I can click on the favicon to the left of the lock (which is to the left of the URL), click on the '>', then "more information", and then "view certificate" to see the certificate. You might not have favicons enabled (I use the favicon restorer add-on to see them) in which case you'd probably be clicking on a blank space to the left of the padlock.

"GeoTrust Global CA" is listed in the authorities tab in Thunderbird's certificate manager. You can access the certificate manager by clicking on "security" in tools -> account settings for any account. The error message is basically saying that Thunderbird doesn't recognize the CA (Certificate Authority) used by the certificate. The CA certificate is used to verify the SSL Client Certificate (whats used to encrypt the connection) returned by the server is legitimate.

Can you get more details about the certificate that it rejected? I don't see a details or view certificate button. You could try clicking on "Or you can add an exception" and see if that provides you more details. It shouldn't actually add the exception without asking you to confirm that you really want to do that, and asking whether you want to make that a temporary or permanent exception.

http://kb.mozillazine.org/SSL_Security_Error

tanstaafl
Moderator

User avatar
 
Posts: 43257
Joined: July 30th, 2003, 5:06 pm

Post Posted February 28th, 2016, 11:28 am

Moved from Thunderbird Features to Thunderbird Support.

WV-Mike
 
Posts: 53
Joined: January 13th, 2008, 6:53 am

Post Posted February 28th, 2016, 2:28 pm

tanstaafl wrote:Try going to https://accounts.google.com/ using Firefox and see if you get the same error. I get a SSL Client Certificate certificate issued by Google Internet Authority G2, which uses "GeoTrust Global CA" as the CA (use the details tab to see that). Typically you'd get the same certificate whether you use Firefox or Thunderbird. In Firefox I can click on the favicon to the left of the lock (which is to the left of the URL), click on the '>', then "more information", and then "view certificate" to see the certificate. You might not have favicons enabled (I use the favicon restorer add-on to see them) in which case you'd probably be clicking on a blank space to the left of the padlock.


I have no trouble accessing Google accounts:

Image

tanstaafl wrote:"GeoTrust Global CA" is listed in the authorities tab in Thunderbird's certificate manager. You can access the certificate manager by clicking on "security" in tools -> account settings for any account. The error message is basically saying that Thunderbird doesn't recognize the CA (Certificate Authority) used by the certificate. The CA certificate is used to verify the SSL Client Certificate (whats used to encrypt the connection) returned by the server is legitimate.


This is the certificate for gmail in Tbird:

Image

tanstaafl wrote:Can you get more details about the certificate that it rejected? I don't see a details or view certificate button. You could try clicking on "Or you can add an exception" and see if that provides you more details. It shouldn't actually add the exception without asking you to confirm that you really want to do that, and asking whether you want to make that a temporary or permanent exception.


When I click to add an exception nothing happens. The screen shot from my original post is all I can get you.

tanstaafl wrote:http://kb.mozillazine.org/SSL_Security_Error

I am afraid this is a bit beyond me...
Thanks for your help and ideas.
WV-Mike

tanstaafl
Moderator

User avatar
 
Posts: 43257
Joined: July 30th, 2003, 5:06 pm

Post Posted February 28th, 2016, 4:41 pm

The certificate in your copy of Thunderbird was issued by Google Internet Authority. It should have been issued by Google Internet Authority G2 (like it was for Firefox). See https://pki.google.com/ .

I have Comcast and Google accounts but the servers tab in my copy of Thunderbird doesn't have a Google Inc entry like your does. The certificate expired in 2011. Try deleting the 5 certificates under Google Inc. in the servers tab, exiting Thunderbird, and restarting.

WV-Mike
 
Posts: 53
Joined: January 13th, 2008, 6:53 am

Post Posted February 28th, 2016, 5:50 pm

tanstaafl wrote:The certificate in your copy of Thunderbird was issued by Google Internet Authority. It should have been issued by Google Internet Authority G2 (like it was for Firefox). See https://pki.google.com/ .

I have Comcast and Google accounts but the servers tab in my copy of Thunderbird doesn't have a Google Inc entry like your does. The certificate expired in 2011. Try deleting the 5 certificates under Google Inc. in the servers tab, exiting Thunderbird, and restarting.



I deleted them, restarted. Still will not connect via Lightning.
-mb

tanstaafl
Moderator

User avatar
 
Posts: 43257
Joined: July 30th, 2003, 5:06 pm

Post Posted February 28th, 2016, 6:48 pm

How does it fail this time? i.e. same error, but different CA?

Have you considered using CalDAV instead of the provider for google calendar add-on?
http://thunderbirdtweaks.blogspot.com/2 ... aldav.html
http://superuser.com/questions/756697/s ... ith-caldav

WV-Mike
 
Posts: 53
Joined: January 13th, 2008, 6:53 am

Post Posted February 28th, 2016, 7:34 pm

tanstaafl wrote:How does it fail this time? i.e. same error, but different CA?

Same error

tanstaafl wrote:Have you considered using CalDAV instead of the provider for google calendar add-on?
http://thunderbirdtweaks.blogspot.com/2 ... aldav.html
http://superuser.com/questions/756697/s ... ith-caldav


I will look into this.
Thanks,
-Mike

WV-Mike
 
Posts: 53
Joined: January 13th, 2008, 6:53 am

Post Posted February 29th, 2016, 11:07 am

I get this error when T bird tries to update.


Image

tanstaafl
Moderator

User avatar
 
Posts: 43257
Joined: July 30th, 2003, 5:06 pm

Post Posted February 29th, 2016, 11:59 am

The http://www.mozilla.org SSL Client Certificate is issued by DigiCert SHA2 Extended Validation Server CA . That listed in the authorities tab in my copy of Thunderbird, and doesn't expire until 10/22/2028 .

Something seems to be messing with your certificates. Are you using Avast!? It roots your certificates. Usually that works okay but sometimes it doesn't integrate correctly and you either get a security error or it has a weird side effect.

Another possibility is that your PC's clock is too out of sync (I think there is about a 2 minute window). I'd expect a different error message if that ocurred but its worth checking it against http://www.time.gov/

WV-Mike
 
Posts: 53
Joined: January 13th, 2008, 6:53 am

Post Posted February 29th, 2016, 3:03 pm

tanstaafl wrote:The http://www.mozilla.org SSL Client Certificate is issued by DigiCert SHA2 Extended Validation Server CA . That listed in the authorities tab in my copy of Thunderbird, and doesn't expire until 10/22/2028 .

Something seems to be messing with your certificates. Are you using Avast!? It roots your certificates. Usually that works okay but sometimes it doesn't integrate correctly and you either get a security error or it has a weird side effect.

Another possibility is that your PC's clock is too out of sync (I think there is about a 2 minute window). I'd expect a different error message if that ocurred but its worth checking it against http://www.time.gov/


I am using Avast.
I disabled it and tried again but I got the same results.

My clock is OK.
Thanks,
-Mike

Return to Thunderbird Support


Who is online

Users browsing this forum: No registered users and 8 guests