Hi everyone, I'm currently in the process of enhancing my NextCloud instance with client certificate authentication and I'm struggling with the DAVx5 setup. Using the provider specific (NextCloud) ...
This may be more of an Android issue than self-hosting, but i run Radicale on my personal server to host caldav/carddav services. I want to login with uname&pword with a certificate. I found this video in Davx5 github page showing that a user can select the cert:
I generated a self-signed cert from my server and installed that to my Android phone via Settings > Security&Privacy > Encryption&Credentials. But i dont get the same as the video. It keeps telling me No certificate found
Clicking the install button and selecting my cert will say
Install CA certificates in Settings
This certificate from null must be installed in Settings. Only install CA certificates from organizations you trust.
Do you install the CA certificate or the client certificate? Because both aren’t the same. The app needs to authenticate with a client certificate file. The server has a server certificate that is checked against the CA certificate. So you’d install that (CA) in the android system certificate store and additionally give a client certificate file to the app.
I have a self-hosted Baikal server with self-signed CA on Android 14 and it works.
However, I didn’t had to add the certificate to Davx⁵ itself. Adding a rootCA into your device and your reverse proxy handling the request should work as expected over https.
Those kind of things are difficult to troubleshoot, this could be:
Bad rootCA certificate, missing the necessary options ?
Wrong certificate handled by your reverse proxy ?
Radicale doesn’t recognize your certificate extension ?
Wrong networking configuration ?
Bug ?
…
We need more infos about your setup:
Do you use a reverse proxy ?
Had you already any success with this certificate within an other application ?
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
selfh.st Newsletter and index of selfhosted software and apps
Just use Login with URL and user name 😁
Yeah that’s what im using right now. But i want to add security by using a certificate when logging in
Add a certificate to the endpoint using your reverse proxy
Do you install the CA certificate or the client certificate? Because both aren’t the same. The app needs to authenticate with a client certificate file. The server has a server certificate that is checked against the CA certificate. So you’d install that (CA) in the android system certificate store and additionally give a client certificate file to the app.
Oh i thought they are the same. I look into how to create a self-signed CA and see if it helps
I have a self-hosted Baikal server with self-signed CA on Android 14 and it works.
However, I didn’t had to add the certificate to Davx⁵ itself. Adding a rootCA into your device and your reverse proxy handling the request should work as expected over https.
Those kind of things are difficult to troubleshoot, this could be:
We need more infos about your setup:
like the other commenter said, CA is different from a client cert. I’ll try that and see how it goes