Implementing Support for Client Certificates (mTLS) #161
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
There was a problem hiding this comment.
Pull request overview
This PR implements mutual TLS (mTLS) support for Nextcloud connections, allowing the app to authenticate using client certificates when connecting to Nextcloud instances behind reverse proxies that require mTLS. The implementation automatically detects when a client certificate is needed during WebView-based login and prompts the user to select a certificate from the Android KeyChain. The selected certificate is persisted in encrypted preferences and automatically loaded on app startup for use with OkHttp requests.
Changes:
- Added client certificate selection and persistence using Android KeyChain API
- Enhanced OkHttpClient initialization to support SSL contexts with client certificates
- Implemented WebView client certificate handling with automatic prompting during login
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 11 comments.
Show a summary per file
| File | Description |
|---|---|
| app/src/main/res/values/strings.xml | Added string resources for client certificate UI elements (preference titles, actions, toasts) |
| app/src/main/java/com/hegocre/nextcloudpasswords/utils/PreferencesManager.kt | Added methods to store and retrieve client certificate alias in encrypted preferences |
| app/src/main/java/com/hegocre/nextcloudpasswords/utils/OkHttpRequest.kt | Added certificate-aware SSL context initialization with thread synchronization for background loading |
| app/src/main/java/com/hegocre/nextcloudpasswords/ui/components/LoginView.kt | Implemented WebView client certificate request handling with KeyChain integration |
| app/src/main/java/com/hegocre/nextcloudpasswords/ui/activities/MainActivity.kt | Added OkHttp client initialization on app startup to persist certificate across restarts |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
app/src/main/java/com/hegocre/nextcloudpasswords/utils/OkHttpRequest.kt
Outdated
Show resolved
Hide resolved
app/src/main/java/com/hegocre/nextcloudpasswords/ui/activities/MainActivity.kt
Outdated
Show resolved
Hide resolved
app/src/main/java/com/hegocre/nextcloudpasswords/ui/components/LoginView.kt
Outdated
Show resolved
Hide resolved
app/src/main/java/com/hegocre/nextcloudpasswords/ui/components/LoginView.kt
Outdated
Show resolved
Hide resolved
app/src/main/java/com/hegocre/nextcloudpasswords/ui/components/LoginView.kt
Outdated
Show resolved
Hide resolved
app/src/main/java/com/hegocre/nextcloudpasswords/ui/components/LoginView.kt
Show resolved
Hide resolved
app/src/main/java/com/hegocre/nextcloudpasswords/utils/OkHttpRequest.kt
Outdated
Show resolved
Hide resolved
app/src/main/java/com/hegocre/nextcloudpasswords/ui/components/LoginView.kt
Outdated
Show resolved
Hide resolved
app/src/main/java/com/hegocre/nextcloudpasswords/utils/OkHttpRequest.kt
Outdated
Show resolved
Hide resolved
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
mTLS Support for Nextcloud Connection
Description
This Pull Request adds support for mutual TLS (mTLS) authentication, allowing the app to connect to Nextcloud instances hidden behind a reverse proxy that requires a client certificate.
Changes
OkHttpRequestto support SSL contexts with aKeyManager. It now initializes theOkHttpClientwith a client certificate from the Android KeyChain when configured.OkHttpClientis automatically re-initialized with the chosen certificate upon app startup (MainActivity), ensuring the user doesn't need to re-select it every time.How to test
ssl_verify_client on..p12certificate on the Android device.Closes #126