views:

47

answers:

2

Hi,

I need to open a specific SSL secured site inside an iFrame of an Adobe-AIR application written in Javascript.

For that reason I've build a small test application which opens the site in a iFrame - this works well, but the server certificate is not accepted. A Popup shows up and prompts the user to accept the untrusted certificate. The server certificate is valid, issued by Trustcenter and is being accepted by default in all major browsers (Webkit, IE, FF, ...). So why does this happen?

To make sure that he server certificate is not a problem, I implemented two other rather common sites, just to see if their certificate is being accepted.

Well.. I just need my application to accept the ssl certificate of my own server. So here's my question: How can I make my application trust "it's home server".

Thanks in advance for your input.

Edit: Here's some example code:

<html>
<head>
    <title>Prototype 1</title>
    <link href="sample.css" rel="stylesheet" type="text/css"/>
    <script type="text/javascript" src="lib/jquery/jquery-1.4.2.min.js"></script>
    <script type="text/javascript">
        var fbOpen = 0;
        function drawFb(link, sbRoot) {

            if (fbOpen != link) {
                fbOpen = link;
                $('#fbContainer').html('<iframe src="'+link+'" '
                                        +'width="700" height="480" ></iframe>')
                $('#fbContainer').show('slow');         
            }
            else {
                fbOpen = 0;
                $('#fbContainer').hide('slow');     
            }
        }
    </script>
</head>
<body style="background-color:yellow;padding:1em;">
    <h3>Example</h3>
    <p>Hi there! This is a basic example showing the usage of Iframes...</p>
    <input type="submit" onclick="drawFb('https://www.example.com/');" value="Test Own" />
    <input type="submit" onclick="drawFb('https://www.google.de/');" value="Test G" />
    <input type="submit" onclick="drawFb('https://www.adobe.com/');" value="Test A" />
    <div id="fbContainer" style="display:none;width:700px;height:480px;border:1px dashed red;"></div>
   </body>

+1  A: 

What you are running into is likely the "same origin policy". Perhaps adobe.com works because core components are already preloaded with an origin of adobe.com?

Make sure in your testing that the server for the iframe is actually the same as the outer HTML page.

This appears to be how you'd configure those exceptional circumstances: http://livedocs.adobe.com/flex/3/html/help.html?content=ProgrammingHTMLAndJavaScript_11.html

Marsh Ray
Hi Marsh Ray and thanks for your reply. I tried the approach to host the outer document containing the Iframe on the same domain, as the iframe points to, but air still asks for the missing certificate. (_http://example.com/test.html_ contains an iframe pointing to _https://example.com/foo/bar.html_. Application opens an iframe pointing to the first URL which is test.html). I tried specifying the documentRoot and the sandboxRoot attribute on the inner Iframe without success. Am I doing something wrong?
Jan.
Another sidenote: right now I do not need the frames content to act as part of the application. Cross-site-Scripting is not required. The frames content ist just used to display informations. Also, The application should be able to fetch files (product export) from the ssl-enabled site.
Jan.

related questions