[jdeluyck]

Hi,

I don't often go through the entire release notes, so when it was time to make another full backup I was surprised to see the Nextcloud options there

Unfortunately it doesn't seem to accept selfsigned certificates. I have my own certificate authority I use to sign certificates I use on my selfhosted infrastructure. I also added this in android, and it is accepted, but Mobilesheets doesn't accept it:

   

I tried the old way to backup to nextcloud - system browser, go the nextcloud, but there I keep getting errors "cannot create file" - while the nextcloud itself works fine.

[sciurius]

I seem to recall there is an Android setting where you can import your own CA certs. I used than years ago before I switched to Let's Encrypt.

[jdeluyck]

I seem to recall there is an Android setting where you can import your own CA certs. I used than years ago before I switched to Let's Encrypt.

Yes, and my certificates are imported in there. MS seems to have its own certificate store that it's using.

[Zubersoft]

No, MobileSheets does not have its own certificate store. It's just using OkHttp to communicate with the nextcloud server, and I believe it's a security policy on the device that prevents self-signed certificates from being used, as that's actually pretty important to prevent man in the middle attacks. It is a bit work to try to support self-signed certificates (on top of the potential security issues it causes), so I need to know how many users are really going to use this. I did find this article https://oceanairdrop.blogspot.com/2018/0...s-and.html, which shows that I users would have to give MobileSheets both the crt file and the IP address of their local server instance. 

Let me ask this - is your server public facing, or is just on your local network? If it's public facing, you can just get a letsencrypt cert and you'll be fine.

Mike

[jdeluyck]

Unfortunately,  this does not work for locally hosted instances. My nextcloud is not public.

[Zubersoft]

Sorry, our messages crossed paths. I updated my post. So it is possible for me to allow this if I accept a .crt file and an IP address - would you be able to provide that for your local instance?

Mike

[jdeluyck]

They certs are strictly speaking not self signed - they are signed by a trusted CA - my own, which works for all other apps that I have on my device, hence my surprise that MS didn't accept it.

Being able to supply a cert, or even just a checkbox "allow untrusted certs" would work, I guess.

[Zubersoft]

I found an example that may work: https://github.com/binsky08/passman-andr...4b647d0fb6

If I provide a network security configuration that accepts user certificates, that will probably get past the issue with no changes needed in the app.

Mike

[jdeluyck]

Honestly, I don't know. I can just browse to my nextcloud either through the app or the webbrowser (chrome or Firefox) and the certificate is accepted. I did not have to do anything else. 

It is indeed a user ca certificate.

[Zubersoft]

If you are using the Google Play version and want to test a build with a fix, shoot me an email at mike@zubersoft.com. We can verify this works for you with the simple change I made.

Mike

[jdeluyck]

Mail sent!

[sciurius]

(This may drift off slightly)

All my servers are strictly local but I do have an official domain and a web site running at an ISP. This allows me to create Let's Encrypt certifcates for subdomains that I use internally. So I can provide real certificates for nextcloud and other internal servers. This helps a lot, since many tools nowadays refuse non-https access.

The local domain needs to be the same name as the official domain but that's just a matter of running a local DNS/DHCP server.

[jdeluyck]

@sciurius
That's indeed a possibility, but i prefer not to leak my internal setup to the public dns system. I know I could request a wildcard cert, but then I'd have to either inject this manually in various things running on various platforms (lbs, docker containers not behind an lb, lxc, vms, k8s lb, ...), whereas now I have my internal CA using smallstep-ca issuing certs on the fly. I add my own root ca cert to a new device at setup and I'm done with that step.

The solution from Mike worked  so I'm a happy camper.

[sciurius]

FWIW: You don't need your local setup in the public dns. Using RFC-2136 you can request certificates for any host in the domain, exisiting or not. 

Anyway, fine that you're up and running again!

[jdeluyck]

At the risk this goes off topic completely, could you detail that a bit? You've peaked my interest