nextcloud / nextcloud/android

Add check for correct server certificate

Open
#3,305 8 comments 0 reactions 0 assignees View on GitHub
connectivity enhancement needs review security
Dominant language
Kotlin
Stars
5.6k
Forks
2k
Avg merge
2d 18h
Merged PRs (30d)
92

Description

### Is your feature request related to a problem? Please describe.
Having looked a bit deeper into tls connection handling when I regognized that the company I work for intersects tls traffic in their WLAN I'd like to have an option to check the server certificate for being the correct one.
Many companies and even hotels intersect TLS traffic with middle boxes by spoofing server certificates. This is bad as this means someone can look into the connection I have to my Nextcloud server and this affects my privacy.

### Describe the solution you'd like
In order:
a) have the availability to use client certificate for connection or
b) just have an option to check the server certificate againt a hash stored in the client or
c) at least have the ability to use TLSA DNS record for checking.

A clear and concise description of what you want to happen.
b) should be sufficiant and would not need any changes on the server. In case one is using Letsencrpyt a check similar to DNSSEC/DANE would be sufficiant by just checking if the server certificate is really signed by the expected CA (LetsEncrypt X3 in the case).
It would allow to detect if the connection is tried to be tampered and the user should than be presented a warning. Maybe plus the option to connect anyway.

### Describe alternatives you've considered
Another option, but also not always working is a VPN to my home network. VPNs are also blocked in a few companies, hotels, countries.

### Additional context
Add any other context or screenshots about the feature request here.

**NOTE:** Be super sure to remove sensitive data like passwords, note that everybody can look here! You can use the Issue Template application to prefill some of the required information: https://apps.nextcloud.com/apps/issuetemplate

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.