Late warning when "distrust system certificates" checked

[ploink]

The letsencrypt certificate on my server was renewed using automated script, server restarted. Two days and a few hours later I got the security popup from davx5 "Please review the certificate".
Using Davx5 4.4.0.1-ose

I verified from the logs that the server (apache used as proxy to provide ssl for local radicale dav server) restarted after renewal and has not restarted or reloaded since. The old certificate was deleted after successful renewal but I checked my backup and it is still valid for 3 more days.
I remember same issue has happened after previous renewal.
Could this be a security bug?

[sunkup]

Sorry, I don't understand. What do you think should be a bug?

Please have a look here as well:
https://www.davx5.com/faq/synchronization/why-is-my-tls-certificate-not-accepted

[ploink]

The bug is: Why does davx5 generate a warning more than two days after the event? It should warn IMMEDIATELY.

If I remember correctly, previous time was much longer than two days, more like a week or so.
I have checked the "distrust system certificates" option months ago, did not work when it was needed, warned two days too late. The warning came at the moment when I hit the refresh button on my TODO agenda app widget.

I mean, if there is a security event, say a burglary going on, you are not going to schedule in your agenda for next week to call the police. You call 911 immediately.

DavX5 is syncing at regular intervals so it must have encountered the new cert very shortly after renewal yet remained silent.
I am just guessing here, but perhaps DavX5 is checking a cached certificate and not the latest version? Or perhaps it only generates the warning when you sync manually and not with scheduled syncs?

I could do some more testing if you want, forcing another cert renewal.

[sunkup]

Thank you for clarifying.

I have looked into it and for me DAVx5 complains immediately at the next connection attempt after the certificate has changed.

DavX5 is syncing at regular intervals so it must have encountered the new cert very shortly after renewal yet remained silent.

Maybe DAVx5 was unable to sync due to aggressive battery saving behaviour or missing/undetected internet connection (when using a VPN)?

I could do some more testing if you want, forcing another cert renewal.

If you can reliably reproduce the behaviour, please send us verbose logs and we can dive deeper. 👍