For a project of mine I created a small app based on webkitgtk that talks to a SSL server.
And I almost forgot about the libsoup default behavior for SSL certificates checking. By default libsoup and therefore webkitgtk will not do any SSL certificate checks. You need to put something like the following snippet into your code (adjust for your language of choice):
from gi.repository import WebKit session = WebKit.get_default_session() session.set_property("ssl-use-system-ca-file", True)
If you don’t do this it will accept any certificate (including self-signed ones).
This is documented behavior in libsoup and they don’t want to change it for compatiblity reasons in libsoup. But for webkit its unexpected behavior (at least to me) and I hope the webkitgtk developers will consider changing this default in webkit. I filed a bug about it. So if you use webkitgtk and SSL, remember to set the above property.