Android app unable to connect to self-signed TLS

[shesek]

Reported by @sumBTC at https://github.com/shesek/spark-wallet/issues/55#issuecomment-568768291

[ghost]

@shesek Adding a self signed certificate only works for android 6 or lower and since I'm running android 9 it won't work:

"By default, secure connections (using protocols like TLS and HTTPS) from all apps trust the pre-installed system CAs, and apps targeting Android 6.0 (API level 23) and lower also trust the user-added CA store by default."

See this. There is a workaround but I'm not sure you want to implement that.

For me personally, it''s not a problem I can't use the App. I even prefer the browser version because there it was simple to replace usd everywhere with euro (both the values and the labels) accurate to the euro cent (by changing exchange-rate.js and dist/www/app.js and changing -6 to -2). I've used spark-wallet in the city of Arnhem (the Netherlands) and Amsterdam, in real shops/restaurants and then it's important to see prices in the local currency.

[shesek]

Adding a self signed certificate only works for android 6 or lower

Ugh, I see. I wonder why they did that... this makes user trusted certificates much less useful.

It seems like the workaround with <trust-anchors> would allow me to ship spark with some additional trusted certificates that are hardcoded into the app, but can't be used to allow app users to dynamically add their own trusted certificates.

Dynamically trusting certificates should be possible with a custom SSLSocketFactory, but it seems that getting this to work in the Cordova WebView environment is somewhat tricky. It would require sending all HTTP requests through a specialized Cordova plugin instead of the usual web browser XHR (and writing a CycleJS HTTP driver that uses that). And the cordova plugin that I found for certificate pinning appears to only support static certificate files, not dynamic ones.

So, seems like this wouldn't be easy... but getting this to work would be a big win, it would allow certificate pinning (#1) which is significantly more secure than trusting the broken CA system.