Take the 2-minute tour ×

I need to open a specific SSL secured site inside an iFrame of an Adobe-AIR application written in Javascript.

For that reason I've build a small test application which opens the site in a iFrame - this works well, but the server certificate is not accepted. A Popup shows up and prompts the user to accept the untrusted certificate. The server certificate is valid, issued by Trustcenter and is being accepted by default in all major browsers (Webkit, IE, FF, ...). So why does this happen?

To make sure that he server certificate is not a problem, I implemented two other rather common sites, just to see if their certificate is being accepted.

Well.. I just need my application to accept the ssl certificate of my own server. So here's my question: How can I make my application trust "it's home server".

Thanks in advance for your input.

Edit: Here's some example code:

    <title>Prototype 1</title>
    <link href="sample.css" rel="stylesheet" type="text/css"/>
    <script type="text/javascript" src="lib/jquery/jquery-1.4.2.min.js"></script>
    <script type="text/javascript">
        var fbOpen = 0;
        function drawFb(link, sbRoot) {

            if (fbOpen != link) {
                fbOpen = link;
                $('#fbContainer').html('<iframe src="'+link+'" '
                                        +'width="700" height="480" ></iframe>')
            else {
                fbOpen = 0;
<body style="background-color:yellow;padding:1em;">
    <p>Hi there! This is a basic example showing the usage of Iframes...</p>
    <input type="submit" onclick="drawFb('https://www.example.com/');" value="Test Own" />
    <input type="submit" onclick="drawFb('https://www.google.de/');" value="Test G" />
    <input type="submit" onclick="drawFb('https://www.adobe.com/');" value="Test A" />
    <div id="fbContainer" style="display:none;width:700px;height:480px;border:1px dashed red;"></div>

share|improve this question
I don't know if you're using Linux or not but this still might help: kb2.adobe.com/cps/408/kb408085.html ... There's a section on where certificates for SSL are stored for Adobe AIR called "SSL certificate store". Modifying the CA store for every user might not be a viable option, obviously, but maybe adding your cert will help you diagnose the problem. –  dlongley Oct 25 '10 at 21:45
Hi dlongley! Thanks for your comment. I'm myself working on Linux, but the application should work with OS-X and WIndows as well. I already stumbled across the page you posted and did not manage to get any closer to a solution. –  Jan. Oct 27 '10 at 14:50
add comment

2 Answers

What you are running into is likely the "same origin policy". Perhaps adobe.com works because core components are already preloaded with an origin of adobe.com?

Make sure in your testing that the server for the iframe is actually the same as the outer HTML page.

This appears to be how you'd configure those exceptional circumstances: http://livedocs.adobe.com/flex/3/html/help.html?content=ProgrammingHTMLAndJavaScript_11.html

share|improve this answer
Hi Marsh Ray and thanks for your reply. I tried the approach to host the outer document containing the Iframe on the same domain, as the iframe points to, but air still asks for the missing certificate. (example.com/test.html contains an iframe pointing to example.com/foo/bar.html. Application opens an iframe pointing to the first URL which is test.html). I tried specifying the documentRoot and the sandboxRoot attribute on the inner Iframe without success. Am I doing something wrong? –  Jan. Oct 28 '10 at 15:00
Another sidenote: right now I do not need the frames content to act as part of the application. Cross-site-Scripting is not required. The frames content ist just used to display informations. Also, The application should be able to fetch files (product export) from the ssl-enabled site. –  Jan. Oct 28 '10 at 16:01
add comment
up vote 0 down vote accepted

I seems that this is a bug in AIR on Ubuntu 64-Bit. When I test the application on Vista, Win7 or MacOS, then the app does not ask for a certificate.

share|improve this answer
add comment

Your Answer


