actualbudget / actualbudget/actual

[Bug]: Electron App cannot sign in with self-signed certs when cert contains non-English alphabet characters.

Open
#4,390 0 comments 1 reaction 0 assignees View on GitHub
electron
Dominant language
TypeScript
Stars
28.7k
Forks
3k
Avg merge
2d 11h
Merged PRs (30d)
65

Description

### Verified issue does not already exist?

- [x] I have searched and found no existing issue

### What happened?

I cannot confirm this on any other OS other than Windows 10 and Windows 11.

When trying to sign in to a self-hosted server protected by a self-signed certificate, you are prompted to provide the CA certificate to validate the server.
If the certificate is named, OR resides in a folder on the OS containing a character not present in the English alphabet (ø å æ õ for example) then the certificate cannot be imported and login fails.

Opening the developer tools shows a pair of traces as follows:

File name containing a European character:
```bash
Server Log: Warning: Ignoring extra certs from `C:\hello\internalæ.crt`, load failed:
error:02000002:system library:OPENSSL_internal:No such file or directory
```

Folder name containing a European character:
```bash
Server Log: Warning: Ignoring extra certs from `C:\hellõ\internal.crt`, load failed:
error:02000003:system library:OPENSSL_internal:No such process
```
```bash
Server Log: TypeError: fetch failed
at node:internal/deps/undici/undici:12345:11
at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
at async lf (C:\Program Files\WindowsApps\actualbudget.org.ActualBudget_25.2.1.0_x64__6q3amkrs0bv0p\app\resources\app.asar\build\loot-core\lib-dist\electron\bundle.desktop.js:83:5067)
at async Eu.subscribe-needs-bootstrap (C:\Program Files\WindowsApps\actualbudget.org.ActualBudget_25.2.1.0_x64__6q3amkrs0bv0p\app\resources\app.asar\build\loot-core\lib-dist\electron\bundle.desktop.js:313:4561) {
cause: Error: unable to verify the first certificate
at TLSSocket.onConnectSecure (node:_tls_wrap:1674:34)
at TLSSocket.emit (node:events:518:28)
at TLSSocket._finishInit (node:_tls_wrap:1085:8)
at ssl.onhandshakedone (node:_tls_wrap:871:12) {
code: 'UNABLE_TO_VERIFY_LEAF_SIGNATURE'
}
}
```

Moving the certificate to another folder and ensuring the filename doesn't contain these characters works as expected.

### How can we reproduce the issue?

Attempt to import a self-signed certificate containing å, ø, æ, õ, ã, or similar character from outside of the US alphabet.

### Where are you hosting Actual?

Docker

### What browsers are you seeing the problem on?

Desktop App (Electron)

### Operating System

Windows 11

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.