nextcloud / desktop

💻 Desktop sync client for Nextcloud
https://nextcloud.com/install/#install-clients
GNU General Public License v2.0
2.9k stars 772 forks source link

[Bug]: SSL client certificate broken with 3.12.2 connection wizard #6584

Open k-neon opened 3 months ago

k-neon commented 3 months ago

⚠️ Before submitting, please verify the following: ⚠️

Bug description

The Nextcloud Connection Wizard can't proceed with the account creation because it shows a 400 Bad Request error where the web server does not receive the SSL client certificate. It ist not possible to add the account. This worked perfectly with the previous 3.9.3 client, but now with 3.12.2 it no longer works.

Steps to reproduce

  1. Add a new account (Account -> Add new)
  2. Click "Log In" button
  3. Add Server Address
  4. Click on "Configure client-side TLS certificate"
  5. Load pkcs12 client-side cert and enter cert password
  6. Now appears the error

Expected behavior

It should be possible to add a new account to the client through the Nextcloud Connection Wizard which has an SSL client certificate in order connect to the Nextcloud server which requires client certificate authentication.

Which files are affected by this bug

not files

Operating system

Windows

Which version of the operating system you are running.

Win 11

Package

Other

Nextcloud Server version

27.1.7

Nextcloud Desktop Client version

3.12.2

Is this bug present after an update or on a fresh install?

Fresh desktop client install

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

Are you using an external user-backend?

Nextcloud Server logs

No response

Additional info

No response

e-cite commented 3 months ago

Could this be related to https://github.com/nextcloud/desktop/issues/863 ?

freebeat commented 2 months ago

Same issue here, except that I don't see the 400 Bad Request error. I tried this on 3.12.3stable-Win64 and also on 3.12.3 on ubuntu.

camilasan commented 2 months ago

I assigned myself to investigate this, didn't reproduce this yet.

functionpointer commented 1 month ago

Should pretty easy to reproduce. All that's needed is nginx with TLS client authentication. Then try to add an account: image

functionpointer commented 1 month ago

I found another bug: When HSTS is configured, the dialog for entering client certificate doesn't appear at all.

WinkelB commented 1 week ago

6493

Yesterday, I had no problems logging into the desktop app with mTLS settings enabled. However, I can confirm that I'm also experiencing issues with HSTS enabled.