Certificate trust not applied to apps
- /e/OS version: 3.2
- Device model(s): Fairphone 6
- Impacted Application: ~
- Affected application/URL: Firefox or Home Assistant app (example)
- Browser/client and version: Any
The problem
The e/OS user certificate trust store appears to work on pre-installed apps such as the system browser. However, it does not seem that added custom certificates are shared with any user-installed application.
Examples:
- In the Home Assistant app, I cannot access my internal URL https://...local whereas the system browser will open it just fine. Home Assistant reports an untrusted certificate.
- A local web server with a custom certificate authority cannot be opened via Firefox, but only through the pre-installed browser. Firefox reports an untrusted certificate.
For comparison, any other client used for reference (e.g. Linux desktop, Fairphone 3 with stock Android) with the same certificate trust setup reports the certificate as valid.
Steps to reproduce
- Create a custom certificate authority.
- Set up a web service that uses a signed certificate for TLS encryption (e.g. Caddy, Home Assistant). Note that for reproducing this, given a CA, Caddy web server can easily set up to use this CA and issue valid certificates automatically.
- Add the CA in e/OS settings "Privacy and Security" -> "More ..." -> "Encryption & Credentials" -> "Install certificate" (items might be inaccurate, translated from German language settings)
- Open the hosted site from the pre-installed Browser and verify it is accessible, where the certificate is valid.
- Open the hosted site or service from the Firefox app. The certificate is not trusted. Same goes for any other app that the user has installed via an app store (App Lounge, F-Droid etc) if it is relies on HTTPS access.
Technical details
Paste any relevant logs (adb logcat) in the codeblock below if you have any
Edited by Matthias Erll