Issues with trusted CA-Certificates

lark6995

Hi,

my Caddy Local Authority Cert is installed and will work as expected with Vanadium and Nextcloud app. But after recent update of GrapheneOS and restart of device (yesterday) it won't work anymore with firefox and Nextcloud Memories app.

Until the update it worked with all apps installed.

Any ideas how to solve this?

Thanks

GrouchyGrape

lark6995 what sort of error are you receiving indicating that it isn't working?

secrec

lark6995 my Caddy Local Authority Cert is installed and will work as expected with Vanadium and Nextcloud app. But after recent update of GrapheneOS and restart of device (yesterday) it won't work anymore with firefox and Nextcloud Memories app.

It isn't clear why you are installing a custom CA. From my brief research, caddy uses letsencrypt, which is already trusted, so you shouldn't have to do anything. Unless you're doing something screwy like not using DNS or telling caddy to generate self signed certificates? If that's the case, you can get domain names for FREE and set it up properly, then you won't have to muck around with this kind of thing.

lark6995

Same URL, always configured with "TLS internal" from Caddy, root cert was installed:

Memories App:
"Failed to load due to SSL error: 3"

Firefox:
"This website requires a secure connection"

Vanadium:
No error - trusted certificate, website works

Nextcloud App:
no error, works as expected

r134a

secrec

lark6995 always configured with "TLS internal"

Tls internal indicates op indeed is using a self signed cert. I'm no expert but i also use caddy with a self signed cert for some services selfhosted on my homeserver.
I don't want a public domain name and this works fine as is on my internal network aswell as in tailscale.

Fwiw to op, i don't have memories but i have IronFox, and have no issues, so perhaps it is a configuration issue on your side? What exactly are u reverse proxying to? 1 or more services? Does 1 not work or all not work? Perhaps some CORS issue?

GrouchyGrape

lark6995 I wonder if an update broke the way apps use device certs. Either that, or coincidence with app updates. Can you test another browser, e.g. Brave?

Fwiw, I find it much easier to rely on the proxy pulling/serving certs from valid CA's. Makes all of this much easier.

lark6995

secrec well here are certainly many reasons why it makes a lot of sense to be able to upload a certificate—one of which has already been mentioned by user r134a . In my case, a similar situation is causing me to install the certificate myself.

The point is that the installed certificate was being used as expected by my apps until just a few days ago, and now, suddenly, it no longer works. I'm trying to figure out why this is happening on my device. If others who are reading this have had the same experience, maybe we can figure out what’s going wrong more quickly…

r134a

lark6995 i had a similar issue a while ago on one of the services i reverse proxy to, and the cause was CORS related. I didn't confige something right but it worked, then chrome based browsers updated and became stricter relating CORS and didn't work anymore till i looked into it and fixed the misconfigurarion.

On another note, perhaps through an update of firefox, ar u sure the option 'use third party CA certificates'(Allows third party certificates from Android CA store) is still enabled?

Perhaps its an option to check on desktop firefox if u have the same issue, if so perhaps developer tools might indicate the issue?

I don't think it is GrapheneOS related, since i have no issues on IronFox with a self signed caddy cert, which i mainly only use for this purpose. I Don't have Memories but i do have a nextcloud instance, i'll try that app if i just can enter my nextcloud domain and report back.

r134a

It seems to work, but it seems to expect an api for memories on the nextcloud instance itself which i probably have disabled.

lark6995

@r134a thank you - in my case its a split DNS setup and everything works fine when I'm not at home and the apps will use the Let'S encrypt cert.
As soon as I'm home, some apps won't use the cert i've installed for the private net. It works fine on all devices and OSs (osx, ios, linux, windows) except graphene.

r134a

lark6995 I can't be really of any help anymore since it seems to work in my case. However are u using a local domain,s ay nextcloud.home? Or a public domain? I'm using a local domain and have no issues.

In case of public domain, might be the issue lays there somewhere if a public domain resolves to a local ip and uses a private CA or something? Just guessing here though, because u mentioned splitDNS setup.

GrouchyGrape

lark6995 is there a reason you're trying to use self-signed at home, but CA-issued externally? Why not use the CA-issued internally? I understand the occasional need for self-signed certs, I use them at work all the time. It's just always easier to use already trusted TLS sources. Everything "just works".

If there's a privacy/security benefit to your self-signed solution, enlighten me.

If you don't care to answer, because I'm not able to help your current problem, feel free to ignore my question. Won't hurt my feelings a bit.

GrouchyGrape

lark6995 it wont pull a cert into the private network

I haven't personally used caddy, though it can definitely use CA-issued certs internally via let's encrypt. Certs don't care if the client is coming from a private/non-private IP.

lark6995 I dont want to expose it to the internet.

First: you don't have to expose it to the internet, it can be used exclusively on your private network and nowhere else.

Second: you already said you're exposing self-hosted services externally? See this:

lark6995 in my case its a split DNS setup and everything works fine when I'm not at home and the apps will use the Let'S encrypt cert

How exactly are you connecting when not at home? It's via one of the two methods I mentioned in my previous comment.

lark6995

In DAVx5 I've found a toggle to switch use of self-installed certs on/off. In firefox and memories I was not successful finding a similar thing. After initial investigation I agree with you that there might be an issue within firefox and memories and not with graphene.

naibed

lark6995
I've experienced the same thing for weeks (months?) fwiw... IronFox still has a popup alert while Vanadium trusts the sites the certs and operates as expected.

lark6995

@GrouchyGrape I think its a bit off topic but i appreciate your advice and would like to use an lets enrypt cert. But afaik there is no way to use them for a server with private ip right?

GrouchyGrape

lark6995 no, you can (nearly) always use CA-issued certs. Easiest way is using a reverse proxy (e.g. caddy, traefik, nginx, etc) that pulls the certs via let's encrypt, then use a local DNS resolver (e.g. pi-hole, adguard home, etc) to point to the proxy (private IP) for when you're home.

When you're away from home, you'll obviously need a different solution. You basically have two:

Use public DNS records to point home if you have a unique IP (more complicated) or use cloudflare tunnels (easy)
Create a device-to-home tunnel using a VPN/network overlay solution (e.g. wireguard, tailscale, unifi teleport, etc.)

There are pros and cons to either solution, just depends on your use case. Regardless, it can be very easy to do if you already have the infrastructure set up.

lark6995

Sorry I don't understand this. I have caddy as rp in a private network and it wont pull a cert into the private network therefore I had to use tls_internal. I dont want to expose it to the internet.

starglider

Okay, two things, first on manually installed self-signed certificates, Vanadium uses the system store by default; it makes sense why it would work. Firefox, however, requires an extra step to do so: open Firefox settings; scroll down to About Firefox; tap on the logo five times; go back to Settings; enter the newly-revealed debug menu; and enable "third party certificates." That should make Firefox/Ironfox behave like Vanadium.

Second, you definitely can have a custom domain point to a private IP address. Here's some documentation that explains how to do it (it's for Vaultwarden, but the concept should apply just as well to Nextcloud or anything else; use the Cloudflare option): https://github.com/dani-garcia/vaultwarden/wiki/Running-a-private-vaultwarden-instance-with-Let%27s-Encrypt-certs

If you go the second route, there's no need for custom self-signed certs, because your domain will have a genuine TLS cert issued for it (even though it's pointing to a private IP range, it'll still be a valid cert).

lark6995

starglider tahnk you very much. Given that I want to use self-signed certificates, I can use firefox again and secondary, I have additional proof that the GOS installed certificate works as expected.
I'll get used to the fact that not all apps provide support for these certs.

Thank you!