wordpress-mobile / wordpress-mobile/WordPress-Android

Self Signed SSL login works for 6.9.1, does not work for 7.0, 7.x

Open
#6,416 11 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

[Pri] Low [Type] Bug Core Login
Dominant language
Kotlin
Stars
3.2k
Forks
1.4k
Avg merge
1d 11h
Merged PRs (30d)
69

Description

I was on autoupdate on google-play-app-store
Downgraded to 6.9.1
tried a few things.
I'm going to not upgrade beyond 6.9.1 for a while.

Expected behavior
  • start app
  • fill in username, passwd, self-hosted ssl url
  • dialog prompts to ask to allow self signed unverifyable ssl certificate, say yes,
  • should login, for 6.9.1 site screen shows up, but does not for 7.0 and above
Actual behavior
  • does not login after wordpress android app 7.0 vercode:376 upto 7.9.1-rc2
  • login succeeds for 6.9.1 vercode:360 (apk retrieved from apkmirror)
Steps to reproduce the behavior
  1. made fresh self signed CA certificate and server certificate
    create a cacert.pem, priv.key, host.crt, host.key as described in
    http://www.eclectica.ca/howto/ssl-cert-howto.php
  2. desktop: add certificate to firefox on desktop browser
  3. desktop: check that wordpress working from desktop browser
  4. android: add cacert.pem into android settings->general->security->certificates->user
  5. android: check that wordpress site working from android browser
  6. install and try each wordpress apk

App logs uploaded for both cases
wp70_log.txt
wp691_log.txt

Repeated a few times to be sure
7.0, vercode:376 was released on Apr-4-2017: API:16-25
6.9.1, vercode:360 was released on Mar-28-2017: API:16-25
I had not noticed this sooner as had not used wordpress app on phone for a while

Tested on [device], Android [version]

LG G3 D855
Android 6.0 lollypop V30b-GLOBAL-COM

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by comparing the attached wp70_log.txt and wp691_log.txt, then reproduce the login flow across the reported app versions on Android with the self-signed certificate setup. Done means a self-signed HTTPS WordPress site can log in successfully on the affected 7.x versions, as it does in 6.9.1.

Written by the indexing model from the issue text.

Assessment

Tech stack
android
Domain
mobile-dev, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.