Improve sign-in usablility when working with self signed certs.

vauvenal5 / yaga

Nextcloud Yaga - A Nextcloud first gallery app for Android.

https://vauvenal5.github.io/yaga-docs/

GNU General Public License v3.0

137 stars 10 forks source link

Improve sign-in usablility when working with self signed certs. #100

Closed vauvenal5 closed 3 years ago

loveisfoss commented 3 years ago

Just a heads-up. Using Nextcloud on Docker and https through apache2 reverse proxy with letsencrypt certificates.

Cannot log in with "Sign In" button, goes to a blank white page.
Could not log in with "Sign In with Browser", nothing happened with this button. Solved it by commenting out this line from apache conf file: "SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 -TLSv1.2". Sign In with browser now works because I am being asked to accept or not if I trust the certificate! (After some trial and error the problem was that I was disabling the TLSv1.2 one.)

ksapp-dell commented 3 years ago

Hi,

same problem here. I have my Nextcloud available in local network and I can't log in using 192.168.178.xx/nextcloud.(Just a blank page appears). I only can log in from outside my home network with the DNS name.

Oliver

vauvenal5 commented 3 years ago

@ksapp-dell are you using a properly signed certificate? Which version are you using? Why not login from within the network with the dns name?

vauvenal5 commented 3 years ago

@loveisfoss when TLSv1.2 is enabled do you still have to accept the certificate? To really test this you will need to reset the app data. It is a bit strange though that the app asks you to accept the certificate if it is truly a signed let's encrypt certificate.

I myself am using let's encrypt through a reverse proxy. Certificate validation is done at the proxy.

loveisfoss commented 3 years ago

@vauvenal5 Yes, it asks for a certificate validation and it really seems strange.

Other examples:

Firefox and other browsers do not ask for validation and trust the certificate automatically when visiting the nextcloud address in them.
Gnome Online accounts also ask for certificate validation when I open the nextcloud saved bookmark in files manager or open the contacts app that syncs with nextcloud. This happens after every reboot. It also feels strange.

It may be something with my apache reverse proxy configuration. I'll look into it and come back.

vauvenal5 commented 3 years ago

@loveisfoss a few thoughts on this:

Since you have the same behavior with gnome apps it is likely not an issue in the app.
One thing I can think of is that you have a different host or address in the certificate then what you use for access. For example the certificate is issued for host.com but you are accessing the server by ip 192.168.x.y.
Otherwise it most certainly is a config issue either in the reverse proxy or your certificate request.

vauvenal5 commented 3 years ago

The problem this issue is actually describing was about the bad user experience when having to login with a self-signed certificate. This is fixed in v0.23.1 since #34 was closed.

ksapp-dell commented 3 years ago

Hi, F-droid had an update and now I am at Version 0.23.2. The behaviour changed:

I can enter my local address (191.168.178.24/Nextcloud) when logging in
when i proceed with log in, then it asks to accept the certificate.
after that it opens the browser and asks to accept that yaga should get access to my Nextcloud
after accepting my browser takes my credentials
then the browser window confirms that log in is done and I can close the browser
after closing the window and reopening yaga yaga does not show that I am logged in.

What do you need from me to troubleshoot this ?

vauvenal5 commented 3 years ago

@ksapp-dell do you have a properly signed certificate?

loveisfoss commented 3 years ago

@vauvenal5 I think you are right. Asking for confirmation when using letsencrypt is strange, but it doesn't have to do with Nextcloud Yaga. The TLSv1.2 requirement seems to have to do with the app, though, right?

ksapp-dell commented 3 years ago

Hi, I am using letsencrypt to get signed certificates.

vauvenal5 commented 3 years ago

@loveisfoss

https://github.com/dart-lang/sdk/issues/41061 was closed a month ago. SO probably TLSv1.3 support will come automatically with one of the upcoming SDK updates.
Is it possible that you are still in lets encrypt test mode?

@ksapp-dell Actually same issue as with @loveisfoss, if you really have a properly signed certificate then Yaga will not ask you to accept the certificate. Are you really trying to login with your certificate hostname or with your local ip?

loveisfoss commented 3 years ago

@vauvenal5

Is it possible that you are still in lets encrypt test mode?

I am just using swag on Docker to get certificates for duckdns domain with dns validation method. I don't know what testing mode of letsencrypt is, hmm...

Edit: I had a configuration error. I was using cert.pem instead of fullchain.pem in my apache configuration. After changing to fullchain.pem no further confirmation is needed. It fixed also my log in problem to Nextcloud bookmarks (Android app). BIG thanks for this, even if it was an indirect and kind of off-topic problem! :)

vauvenal5 commented 3 years ago

@loveisfoss glad you could resolve it :)

vauvenal5 commented 3 years ago

This was fixed in v0.23.1.