Android: Sites requesting Client Certificate not working on Android

[theyoz]

Websites are not working if they require a client certificate. Client certificate are uploaded.

Step to reproduce:

• Upload pkcs12 Client Certificate (I can provide you a certificate and test site)
• Go to the site with Google Chrome it works (Android add it for app and/or vpn use)
• Go to DuckDuckGo and it fails

[cmonfortep]

@aitorvs I know you worked on something related to certificates in https://github.com/duckduckgo/Android/pull/1031 and maybe you are more familiar than me here. Could you check if this is due to a WebView limitation or it's a bug? Thanks

[aitorvs]

@theyoz thanks a lot for reporting this. Can you provide us with the cert and test site to repro the issue?

[theyoz]

Issue 1. Install the certficate
URL: http://test.yoram.me/download/ddg.p12
Password: duckduckgo

Response:
HTTP/1.1 200 OK
Content-Type: application/x-pkcs12

Video explaining the problem: https://user-images.githubusercontent.com/26814402/104548307-32c79f80-5639-11eb-95be-72c882eca39a.mp4

Issue 2. Accessing sites with Client Certificate

When I go to a site requiring a client certificate, it fails under DDG but works under Chrome

Video explaining the problem: https://user-images.githubusercontent.com/26814402/104549175-fb59f280-563a-11eb-8ac9-370f132ea1c3.mp4

_All videos are in H.265 - Under Windows you may need a codec and plugin under existing browser (you may only hear the sound otherwise). You can also download and use VLC _

[aitorvs]

@theyoz thanks a lot for this report and your thoroughness describing it. It is very useful.
I can confirm this is indeed bug on our side.

@cmonfortep I have created an internal task for this so that we can triage it https://app.asana.com/0/414730916066338/1199561121099458/f

[theyoz]

Guys,

Not sure If you had time to work on it but this work for me: https://github.com/duckduckgo/Android/pull/1078

[cmonfortep]

We have an internal task to work on this issue in our backlog. I've tagged the Issue as Will Fix by our team.

We recently updated our contribution guidelines to improve how we deal with reported issue.