search

cordova-ccafix / cordova-plugin-client-certificate-support

Cordova Client Certificate authentication support for both iOS and Android (limited testing of updates on Android)
Apache License 2.0
3 stars 4 forks source link

Sending a Certificate Chain #6

Open msbsh opened 5 years ago

msbsh commented 5 years ago

Hi @brodybits,

first of all thanks for building this plugin. It's exactly what we need for our project!

One question on your implementation though. We are receiving an error within our backend, that says null certificate chain, from which I suggest, that not the whole chain (e.g. CA and client cert) are being sent to the server, but only the client cert. Is that correct?

I'm not an ObjectiveC/Swift developer myself but the code in ClientCertificate.m#L153-L159 looks like it. If my suggestion is correct could you give me some pointer on how to implement sending the complete chain?

Regards, Martin

brodycj commented 5 years ago

We are receiving an error within our backend, that says null certificate chain, from which I suggest, that not the whole chain (e.g. CA and client cert) are being sent to the server, but only the client cert. [...] [...] [...] the code in ClientCertificate.m#L153-L159 looks like it.

Linking to src/ios/ClientCertificate.m#L153-L159 @ 71dda4d99 for easy reference.

I have to say that something does not sound right. I have already tested client certificate authentication with a Node.js server (ccatesting.com), and some other app developers have succeeded with various versions of the implementation on both iOS and Android.

From a quick search of "null certificate chain" I found some discussions of "null cert chain" exception messages on Java. At this point I have no idea whether or this Java exception message is related to this issue.

In case a change is needed on this plugin, please post some information about what kind of a server you are using and some instructions on how the client certificate authentication should be done with that server. A minimal, reproducible example ([1]) would really help us and others in the user community analyze why it is not working correctly and some alternatives about how we can reach a proper solution.

This issue is marked as an invalid question for now.

[1] https://stackoverflow.com/help/minimal-reproducible-example

msbsh commented 5 years ago

I dug a bit deeper yesterday and can now reproduce the behaviour. It seems the plugin does not answer the server's certificate challenge at all and is not sending a client certificate.

The registration of the .p12 file (which I included within the project for testing purposes) returns successfully, yet the didReceiveAuthenticationChallenge function in ClientCertificate.m is not being called.

This makes me suspect, that is has something todo with #7 as well.

brodycj commented 5 years ago

I dug a bit deeper yesterday and can now reproduce the behaviour. It seems the plugin does not answer the server's certificate challenge at all and is not sending a client certificate. […]

The minimal reproducible example that I requested before would increase the chance of a quicker investigation from the maintainer (myself) and others in the user community.

This makes me suspect, that is has something todo with #7 as well.

(Test with WKWebView plugins on iOS)

Interesting. That comment implies to me that you would be using a WKWebView plugin. Again, a minimal reproducible example would likely help speed things up.