TLS Client/mutual authentication

[almandin]

• Your Rocket.Chat Experimental app version: 4.4.0
• Your Rocket.Chat server version: 2.4.9
• Device (or Simulator) you're running with: android 7.0

Hi there,
I'm trying to install rocket chat with TLS client authentication. I currently set it up with Traefik and it is working like a charm but the application won't connect to the server despite my user certificate being valid and available in the android user certificate store.
I tried to access the rocket chat server with a web browser with the android phone and everything works well (server-side configuration with traefik is valid, the user certificate is valid and is signed by the CA configured in traefik).

I saw this commit, merged in the develop branch : #1125 and the associated branch feature.ssl-pinning which seems to allow that feature.

Am I wrong about rocket chat supporting client authentication ? Is it implemented ? If not, will it be soon ?
Thanks for your help.

[diegolmello]

It's not implemented on Android yet.

[almandin]

Okay, I thought this git repository was android specific but I guess the same code base runs on both android and iOS systems. Any chance for it to be implemented soon for android ? :)

[almandin]

A PR was filed for the legacy android app btw : RocketChat/Rocket.Chat.Android#2007

[diegolmello]

@almandin Nice! Thanks for bringing attention to this.

[CantBelieveThisWorks]

@diegolmello Could you comment on what is missing to get commit #1125 running on android?
On first glance, the only difference seems to be that on iOS it is showing the certificatePicker, and therefore, a client certificate can be used.
So, is the bottleneck in the way Android is treating certificates, and therefore, only a new certificatePicker for android has to be written, or is there more missing to get this running on Android?

[djorkaeffalexandre]

Hey @CantBelieveThisWorks, it's not easily to do, we need to change the core of React Native adding a SSL Pinning before all requests and websocket connection.
Select the certificate is the more easy part of this, the complexity is to pin this certificate on OKHTTP builder and handle the websocket, how you can see on the legacy android app it's not implemented on websocket layer because it's really hard, and for us it have some extra complication because we're using a framework (React Native) that wrap somethings about network.
Without websocket connection you can't use our app, it'll raise a lot of issues.
Feel free to implement this, if you want.
Just for my information, it's working fine to your server on iOS Devices?
Thanks in advance.