🔑 Use SSL Client Certificate to improve security

[Heracles31]

Expected behaviour

Option to configure a Nextcloud account to include an SSL User's Private Key and Certificate to connect to the server.

The use of an SSL Client certificate greatly improves the security. It protects the SSL connection against SSL decryptors deployed here and there and many other threats. It also improves the security in the mobile device by moving the private key to a memory space where nothing can touch it.

As a first step, it should be easy to add this as an extra option to account but still require the password or the access token. In a further release, it would be possible to use the certificate as the only authentication but that requires more effort and more config in the SSL engine facing the Nextcloud service as well as in the Nextcloud config itself to map certificates names to usernames.

Actual behaviour

To use such a client side certificate is not an option as of now

Steps to reproduce

N/A

iOS version

N/A

App version

Latest

Server configuration

N/A

Operating system:
N/A

Web server:
N/A

Database:
 N/A

PHP version:
N/A

Nextcloud version: (see Nextcloud admin page)
 N/A

[suunkie]

+1
Yeah i like to have that too.

[cecom]

+1 😁

[fhoner]

+1

[renini]

This would definitely be great option to improve security

[binlab]

TLS client certificate is a powerful feature to improve security and add addition factor to it

[alexswerner]

+1 here.
I tried and added my client certificate to the ios certificate store, but this does not seem to be sufficient. After adding the certificate safari can access the server, but the Nextcloud client reports:
Connection error: The network connection was lost. Without the client certificate this setup works.

[pellaeon]

According to Apple documentation, apps have to write their own code to import SSL client certificates. It also outlines how to implement the feature. Hope to see support for this.

[boombata]

+1
Would be very nice to have this feature for IOS ( also for Android and Windows clients :) )

[tdotu]

+1

[lfdla]

+1

[aniqueta]

Came here searching for this, and so adding another vote. I know this is sadly a problem with iOS and Apple's design decision to not allow apps to access the system keychain. Appreciate any time spent on a workaround.

[binlab]

@marinofaggiana could you please look at this issue? A lot of voting for this. Since this possibility is implemented into the Desktop Nextcloud Сlient and provides a considerable enterprise level of additional security, also prevents any brute-force attacks to Nextcloud endpoint by the application level and provides protected access on the network level. Nowadays, an alternative solution for providing the same level of security is using a VPN tunnel (such as OpenVPN by certificates access), which is much less convenient on mobile devices.

[jogalt]

Ditto to this request. Multi factor Auth with trusted PKI is the only great way to bump security exponentially.

[marinofaggiana]

Hi all, I'm doing some tests in development, who wants to participate?

[jogalt]

I'm in.