mirror of
https://github.com/actualbudget/actual.git
synced 2026-07-16 07:04:23 -05:00
[GH-ISSUE #3304] [Bug]: Desktop App: Server is not running at this URL. #98765
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/actual#98765
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @atrueresistance on GitHub (Aug 22, 2024).
Original GitHub issue: https://github.com/actualbudget/actual/issues/3304
Verified issue does not already exist?
What happened?
I'm having an issue with the web server connecting to the desktop application.
The server is up and running using HTTPS and a self signed cert.
Having a self signed cert, you would normally be prompted in Chrome stating that the certificate is not valid. It's probably not the best way to go about it, but if you add it to the Trusted Root Certification Authorities for the current user Chrome inherently trusts it solving the warning. At least on the local machine for the current logged on user. I don't intend on opening the server to the outside, just LAN connection is good enough for me.
The desktop application is being ran on the same machine and user that the certificate was added to the Trusted Root Certification Authorities store.
Where are you hosting Actual?
Docker
What browsers are you seeing the problem on?
Desktop App (Electron)
Operating System
Windows 11
@MikesGlitch commented on GitHub (Aug 22, 2024):
Confirmed - I'm seeing this also. This may be tricky - we do n't want to turn off TLS validation for security reasons. Having said that, disabling it does work:
Anyone got any thoughts on the best approach here?
@psybers commented on GitHub (Aug 22, 2024):
https://stackoverflow.com/questions/38986692/how-do-i-trust-a-self-signed-certificate-from-an-electron-app
@atrueresistance commented on GitHub (Aug 22, 2024):
I'll start of with I know nothing of electron apps. I do agree that TLS validation off is not the default way to ship.
I'm not sure how much work it would be, but would it be possible to have a configuration item in the desktop app that whitelists a specific certificate serial number?
https://www.electronjs.org/docs/latest/api/session#sessetcertificateverifyprocproc
If the certificate is installed in the current user's certificate store can the desktop app use is directly from the store?
@MikesGlitch commented on GitHub (Aug 22, 2024):
We have a bit of an odd setup, we run our loot-core server process (that calls the API and gets the error) in a forked process.
I think that means the session's setCertificateVerifyProc won't pick it up.
Maybe we can configure node-fetch for Electron to figure out the root store 🤔
@MikesGlitch commented on GitHub (Aug 24, 2024):
I have a draft pr up - as expected the electron setCertificateVerifyProc wont work. The only way to make it work is for the user to specify the cert that they want to trust.
@atrueresistance How did you generate your cert? I used makecert to test but want to make sure it also works on your config.
@atrueresistance commented on GitHub (Aug 24, 2024):
@MikesGlitch I used the same command as in the documentation except with a subject alternative name to match the hostname.
openssl req -x509 -nodes -days 365 -addext "subjectAltName = DNS:orangepi3-lts" -newkey rsa:2048 -keyout selfhost.key -out selfhost.crt@MikesGlitch commented on GitHub (Aug 24, 2024):
Thanks, I have a build here: https://github.com/actualbudget/actual/actions/runs/10541997136/job/29208287390?pr=3308
Can you confirm if it fixes this issue? If you try it, don't forget to backup your budget first.
@atrueresistance commented on GitHub (Aug 26, 2024):
This app package’s publisher certificate could not be verified. Contact your system administrator or the app developer to obtain a new app package with verified certificates. The root certificate and all immediate certificates of the signature in the app package must be verified (0x800B010A)@MikesGlitch commented on GitHub (Aug 26, 2024):
That's what we'd expect for the appx installer - it's for the windows store.
Try the "actual-electron-windows-latest" artifact, that should install as per usual.
@atrueresistance commented on GitHub (Aug 26, 2024):
Is there a link? Sorry I'm not sure where I should be looking.
@MikesGlitch commented on GitHub (Aug 26, 2024):
Ah, this is the direct link to the download: https://github.com/actualbudget/actual/actions/runs/10541997136/artifacts/1850858005
Here's the PR, if interested: https://github.com/actualbudget/actual/pull/3308
@atrueresistance commented on GitHub (Aug 27, 2024):
@MikesGlitch I was able to download the latest and get it running with the self signed cert.
Thank you so much!
@crzdg commented on GitHub (Aug 27, 2024):
Nice. I will soon test this as well. Im using Caddy as proxy, so a short-lived certificate. Can I trust the Intermediate / Root, so the short-lived signed certs work?
@MikesGlitch commented on GitHub (Aug 28, 2024):
I'm not too familiar with Caddy so couldn't say. You can trust a certificate that is locally on the PC that is .crt or .pem format.
@MikesGlitch commented on GitHub (Aug 28, 2024):
Closed by https://github.com/actualbudget/actual/pull/3308
@wgregbrown commented on GitHub (Mar 16, 2025):
Is there anywhere to still get the desktop client that will work with self signed certs. @MikesGlitch put a link
https://github.com/actualbudget/actual/actions/runs/10541997136/job/29208287390?pr=3308
But its empty now.
@MikesGlitch commented on GitHub (Mar 17, 2025):
The latest release has it. You can get it from the GitHub releases page
On Sun, 16 Mar 2025, 23:19 wgregbrown, @.***> wrote:
@neobladerunner commented on GitHub (Apr 4, 2026):
I'm experiencing this issue with latest version 26.3.0 via Flathub. I've generated a self-signed cert via mkcert and can load the app fine via the browser from any device on my network. The desktop app states:
I followed the instructions here to import the root certificate to the desktop app from the device Actual is running on, but the UI doesn't seem to do anything when I import it. Clicking on OK doesn't clear the red error message, and I can't tell if it's rejecting the cert file or not seeing it at all. I suppose I should just use the web client but wanted to try the desktop app if I could.