Add check for correct server certificate
- Dominant language
- Kotlin
- Stars
- 5.6k
- Forks
- 2k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 92
Description
### Is your feature request related to a problem? Please describe.
Having looked a bit deeper into tls connection handling when I regognized that the company I work for intersects tls traffic in their WLAN I'd like to have an option to check the server certificate for being the correct one.
Many companies and even hotels intersect TLS traffic with middle boxes by spoofing server certificates. This is bad as this means someone can look into the connection I have to my Nextcloud server and this affects my privacy.
### Describe the solution you'd like
In order:
a) have the availability to use client certificate for connection or
b) just have an option to check the server certificate againt a hash stored in the client or
c) at least have the ability to use TLSA DNS record for checking.
A clear and concise description of what you want to happen.
b) should be sufficiant and would not need any changes on the server. In case one is using Letsencrpyt a check similar to DNSSEC/DANE would be sufficiant by just checking if the server certificate is really signed by the expected CA (LetsEncrypt X3 in the case).
It would allow to detect if the connection is tried to be tampered and the user should than be presented a warning. Maybe plus the option to connect anyway.
### Describe alternatives you've considered
Another option, but also not always working is a VPN to my home network. VPNs are also blocked in a few companies, hotels, countries.
### Additional context
Add any other context or screenshots about the feature request here.
**NOTE:** Be super sure to remove sensitive data like passwords, note that everybody can look here! You can use the Issue Template application to prefill some of the required information: https://apps.nextcloud.com/apps/issuetemplate
Contributor guide
Assessment
This issue has not been assessed yet.