element-hq / element-hq/element-android

Android stores client certificates are not used by Element app for reverse proxy authentication

Open
#8,420 0 comments 5 reactions 0 assignees View on GitHub
O-Uncommon S-Minor T-Defect
Dominant language
Kotlin
Stars
3.7k
Forks
917
PR merge metrics
No merged PRs in 30d

Description

### Steps to reproduce

1. Configure a Synapse-Matrix homeserver behind an nginx reverse-proxy.
> cat /etc/nginx/sites-available/matrix
```
...
ssl_certificate /home/user/matrix/matrix-server.crt;
ssl_certificate_key /home/user/matrix/matrix-server.key;
ssl_client_certificate /home/user/easy-rsa/pki/ca.crt;
ssl_verify_client on;
...
```
2. Import root AC and client certificate in the android store :

![image](https://github.com/vector-im/element-android/assets/26636480/385b5b6a-165c-46ca-ae03-7e8352f05595)

3. In the server selection, when select the homeserver and press next.

![image](https://github.com/vector-im/element-android/assets/26636480/679b81ed-c6cc-4272-9664-53b2221761ee).

Client certificate authentication is a very interesting security measure as it completly blocks the access to the server behind the reverse proxy to unauthorized devices and I don't think we are the only people that needs / use this so it could be interesting to fix this behavior.

### Outcome

#### What did you expect?
If a client certificate is imported on the Windows operating system certificate store it is automatically used by the element desktop app.

![image](https://github.com/vector-im/element-android/assets/26636480/ee0c25aa-9178-44ea-9962-b96a53fc37e2)

I expect the android app to use the client certificate from the system store like the desktop app.

#### What happened instead?

![image](https://github.com/vector-im/element-android/assets/26636480/679b81ed-c6cc-4272-9664-53b2221761ee)

### Your phone model

One plus 10 Pro and Galaxy A50

### Operating system version

11 and 12

### Application version and app store

1.5.34 and 1.5.32

### Homeserver

synapse matrix homeserver 1.53

### Will you send logs?

Yes

### Are you willing to provide a PR?

No

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.