Android: Feature request: Support for Client Certificate Authentication

[m11tch]

Home Assistant Android version:
1.7.2-128
Android version:
9
Phone model:
Huawei P20 Lite (ANE-LX1)
Home Assistant version:
0.105.4
Last working Home Assistant release (if known):
N/A
Description of problem:
I use nginx to expose home-assistant to the outside world, to keep bad guys away I set up SSL client certificate authentication. While this works fine for 'chrome pinned websites' it does not work for the home-assistant app. (there is no way of selecting the certificate to be used for authentication.)

It would be great if support for SSL Client Certificate Authentication could somehow be added.

Traceback (if applicable):

Screenshot of problem:

Additional information:
Example for setting up Client Certificate Authentication in nginx: https://gist.github.com/mtigas/952344

[robbiet480]

Duplicate of #27 and #214. Please search before opening new issues.

[dmpolukhin]

@robbiet480 could you please explain current status of client certificate support in Android app. As far as I can see all issues that you mentioned are closed but in current app version 1.7.2-128 problem still exists. In my setup client certificate works perfectly in Chrome browser but HA app cannot connect and doesn't even show prompt for certificate selection. Basic authorization on reverse proxy also doesn't work because HA overwrite auth header https://github.com/home-assistant/home-assistant.io/issues/6350 and resolution is "won't fix". iOS story for client certificate https://github.com/home-assistant/home-assistant-iOS/issues/27.

Does it mean that the resolution of the client certificate support issue is also "won't fix" for Android?

[robbiet480]

Client certificates are currently not supported and we have no plans to implement such a feature as it has been deemed too complex and we are too early in the apps life to get there. Would rather be spending time on implementing features that provide value to all users, like better notifications and more sensors.

[bryanyork]

That's a shame. BTW it seems like OpenHab supports this on their app. Will try and see if I can port over their implementation. Would be great to avoid forks.

https://github.com/openhab/openhab-android/blob/72389b8837ab1aec3aa2c7f1d277d4959f4579e4/mobile/src/main/java/org/openhab/habdroid/ui/ConnectionWebViewClient.kt#L74

[ohmer1]

I'm using an nginx reverse proxy with client certificate too. Unfortunately, I can't use the app because it doesn't support client certificate.

[sfjes]

Also would find this useful. Can't use the client because of this limitation.

[Hubro]

I am extremely nervous about opening up my HA install to the internet without support for client certificates :/