HTTPS scenario fails for some zimit files with Chrome

[Popolechien]

Created an image using installer that had the GCFD zim (zimfarm receipe here)

Installation ran fine and upon opening the zim I get the expected "switch to https" warning. But then past this step I only get the little circle going round and round indefinitely and there is no access to content.

[rgaudin]

Doesn't look like a hotspot issue but downloading the ZIM to make sure and maybe transfer.

[rgaudin]

Can't reproduce ; would you mind retesting but opening the developer tools console first (⌥ + ⌘ + I on Firefox) and copy/screenshot its output ? So we can see where it's stuck at.

[Popolechien]

It actually works on Firefox, but not on Chrome. Looking at the dev console I get this: load.js:56 Uncaught (in promise) DOMException: Failed to register a ServiceWorker for scope ('https://kiwix.hello.hotspot/edu.gcfglobal.org_en_all.en/A/') with script ('https://kiwix.hello.hotspot/edu.gcfglobal.org_en_all.en/A/sw.js?replayPrefix=&root=edugcfglobal.org_en_all.en'): An SSL certificate error occurred when fetching the script.

[kelson42]

@rgaudin Does this bug is confirmed? I would be really surprised!

[Popolechien]

I've generated a small config with 5 zimit-generated files and ran them on a RPi 3B+:

Works:

• Les fondamentaux

Does not work

• GCF Global:
• Cheatography
• Music theory
• Low-tech magazine

They obviously all run normally on library.kiwix.org

[rgaudin]

Is the symptom the same for all of them ?

[Popolechien]

Yup. Little round thing going to no end.

[rgaudin]

Ok, you tried different browsers ?

[Popolechien]

Ok, got it:

Chrome (macOS, all extensions deactivated): does not work Firefox (macOS), Chrome (android): I get the below activation page

This being said, Chrome is the dominant browser so it might be worth checking if it is an issue with macOS or if it happens on Windows as well.

[rgaudin]

Thanks ; that's helpful. Pretty sure it happens on all platform ; your initial message make it seems like it.

[Popolechien]

Yep, can confirm that Opera on PC (windows 10) is fine, but not Chrome (Win10).

[kelson42]

@rgaudin Both of us have been quite weak on that one :( @Popolechien Sorry for this pretty stupid and high impacting problem.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be now be reviewed manually. Thank you for your contributions.

[rgaudin]

Chrome (macOS, all extensions deactivated): does not work

Works fine for me, and that does not surprise me as I did test it when implementing the feature (had to take a screencast of it!)

Are you sure you had the problem on macOS? Trying to get a Windows running to test on Windows now.

[rgaudin]

OK, so the problem is after this tutorial, which works on all browsers. It's just that once you've added the exception, you don't see it anymore obviously.

I can reproduce the issue: certificate exception is added but chrome refuses to register the service worker still.

[rgaudin]

OK, unfortunately, Chrome now requires the certificate to be installed on the system to work with Service Workers. The process is thus more complicated with many steps and of course it's different on Windows and macOS.

What should we do?

[Popolechien]

well the simpler for the user the better, no matter the cost on our side.

[rgaudin]

There is no simple way for the user.

The current (other browsers though) solution requires a few clicks in the browser to add an exception for the domain. What we are looking at now is a many steps, multi-software process to get to the same result:

1. Click on “Not secure” button next to address bar
2. Click on “Certificate (invalid)”
3. In the popup, go to Details
4. Click export to file
5. Select a location and name to export to and save
6. Now in explorer, go to that location and double-click certificate
7. Choose install certificate
8. Select “place certificate in following store”
9. Click Browse
10. Select “Trusted root certificates authorities” from the list of similarly named options
11. Confirm
12. Confirm in the warning dialog
13. Exit the certificate manager
14. In chrome, refresh the page you were on

Steps 7-13 are visible in this tutorial

Another alternative, is to ask user:

• To use another browser (Firefox)
• To disable security in chrome by launching it with --ignore-certificate-errors.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be now be reviewed manually. Thank you for your contributions.

[kelson42]

Invalidated with Zimit2