Cannot get Lightning to connect with my Goole account

[WV-Mike]

I am trying to connect my Lightning calendar with my Gmail calendar.
Any time I try this I get a "Secure Connection Failed" error.

If I add an exemption it still will not connect.
I have no prior experience with Certificates, etc.


Here are screen shots

[tanstaafl]

Try going to https://accounts.google.com/ using Firefox and see if you get the same error. I get a SSL Client Certificate certificate issued by Google Internet Authority G2, which uses "GeoTrust Global CA" as the CA (use the details tab to see that). Typically you'd get the same certificate whether you use Firefox or Thunderbird. In Firefox I can click on the favicon to the left of the lock (which is to the left of the URL), click on the '>', then "more information", and then "view certificate" to see the certificate. You might not have favicons enabled (I use the favicon restorer add-on to see them) in which case you'd probably be clicking on a blank space to the left of the padlock.

"GeoTrust Global CA" is listed in the authorities tab in Thunderbird's certificate manager. You can access the certificate manager by clicking on "security" in tools -> account settings for any account. The error message is basically saying that Thunderbird doesn't recognize the CA (Certificate Authority) used by the certificate. The CA certificate is used to verify the SSL Client Certificate (whats used to encrypt the connection) returned by the server is legitimate.

Can you get more details about the certificate that it rejected? I don't see a details or view certificate button. You could try clicking on "Or you can add an exception" and see if that provides you more details. It shouldn't actually add the exception without asking you to confirm that you really want to do that, and asking whether you want to make that a temporary or permanent exception.

http://kb.mozillazine.org/SSL_Security_Error

[tanstaafl]

Moved from Thunderbird Features to Thunderbird Support.

[WV-Mike]

Try going to https://accounts.google.com/ using Firefox and see if you get the same error. I get a SSL Client Certificate certificate issued by Google Internet Authority G2, which uses "GeoTrust Global CA" as the CA (use the details tab to see that). Typically you'd get the same certificate whether you use Firefox or Thunderbird. In Firefox I can click on the favicon to the left of the lock (which is to the left of the URL), click on the '>', then "more information", and then "view certificate" to see the certificate. You might not have favicons enabled (I use the favicon restorer add-on to see them) in which case you'd probably be clicking on a blank space to the left of the padlock.

I have no trouble accessing Google accounts:

"GeoTrust Global CA" is listed in the authorities tab in Thunderbird's certificate manager. You can access the certificate manager by clicking on "security" in tools -> account settings for any account. The error message is basically saying that Thunderbird doesn't recognize the CA (Certificate Authority) used by the certificate. The CA certificate is used to verify the SSL Client Certificate (whats used to encrypt the connection) returned by the server is legitimate.

This is the certificate for gmail in Tbird:

Can you get more details about the certificate that it rejected? I don't see a details or view certificate button. You could try clicking on "Or you can add an exception" and see if that provides you more details. It shouldn't actually add the exception without asking you to confirm that you really want to do that, and asking whether you want to make that a temporary or permanent exception.

When I click to add an exception nothing happens. The screen shot from my original post is all I can get you.

http://kb.mozillazine.org/SSL_Security_Error

I am afraid this is a bit beyond me...
Thanks for your help and ideas.
WV-Mike

[tanstaafl]

The certificate in your copy of Thunderbird was issued by Google Internet Authority. It should have been issued by Google Internet Authority G2 (like it was for Firefox). See https://pki.google.com/ .

I have Comcast and Google accounts but the servers tab in my copy of Thunderbird doesn't have a Google Inc entry like your does. The certificate expired in 2011. Try deleting the 5 certificates under Google Inc. in the servers tab, exiting Thunderbird, and restarting.

[WV-Mike]

The certificate in your copy of Thunderbird was issued by Google Internet Authority. It should have been issued by Google Internet Authority G2 (like it was for Firefox). See https://pki.google.com/ .

I have Comcast and Google accounts but the servers tab in my copy of Thunderbird doesn't have a Google Inc entry like your does. The certificate expired in 2011. Try deleting the 5 certificates under Google Inc. in the servers tab, exiting Thunderbird, and restarting.

I deleted them, restarted. Still will not connect via Lightning.
-mb

[tanstaafl]

How does it fail this time? i.e. same error, but different CA?

Have you considered using CalDAV instead of the provider for google calendar add-on?
http://thunderbirdtweaks.blogspot.com/2 ... aldav.html
http://superuser.com/questions/756697/s ... ith-caldav

[WV-Mike]

How does it fail this time? i.e. same error, but different CA?

Same error

Have you considered using CalDAV instead of the provider for google calendar add-on?
http://thunderbirdtweaks.blogspot.com/2 ... aldav.html
http://superuser.com/questions/756697/s ... ith-caldav

I will look into this.
Thanks,
-Mike

[WV-Mike]

I get this error when T bird tries to update.

[tanstaafl]

The http://www.mozilla.org SSL Client Certificate is issued by DigiCert SHA2 Extended Validation Server CA . That listed in the authorities tab in my copy of Thunderbird, and doesn't expire until 10/22/2028 .

Something seems to be messing with your certificates. Are you using Avast!? It roots your certificates. Usually that works okay but sometimes it doesn't integrate correctly and you either get a security error or it has a weird side effect.

Another possibility is that your PC's clock is too out of sync (I think there is about a 2 minute window). I'd expect a different error message if that ocurred but its worth checking it against http://www.time.gov/

[WV-Mike]

The http://www.mozilla.org SSL Client Certificate is issued by DigiCert SHA2 Extended Validation Server CA . That listed in the authorities tab in my copy of Thunderbird, and doesn't expire until 10/22/2028 .

Something seems to be messing with your certificates. Are you using Avast!? It roots your certificates. Usually that works okay but sometimes it doesn't integrate correctly and you either get a security error or it has a weird side effect.

Another possibility is that your PC's clock is too out of sync (I think there is about a 2 minute window). I'd expect a different error message if that ocurred but its worth checking it against http://www.time.gov/

I am using Avast.
I disabled it and tried again but I got the same results.

My clock is OK.
Thanks,
-Mike