[PM-16157] Support self-host servers using TLS with Client Authentication (mTLS)

[rohm1]

🎟️ Tracking

#4416

📔 Objective

This PR adds a "Client certificate" menu to the custom environment menu. By clicking on a "Choose" button, the native certificate selection menu will open. User can choose a certificate that will be used for connections to a self-hosted instance.

Other apps implement some dynamic logic: if the sever requires mTLS, the user is prompted to select a certificate. While this behavior is more flexible for the user, it is more complicated to implement. With the chosen approach, the app settings must be cleared and a new server must be set up. As users generally do not enable/disable mTLS on a regular basis, I think the tradeoff is acceptable. Additionally the only information that is saved is the certificate name (key alias). If a user update/renew a certificate, as long as the certificate name does not change, the new certificate will be used and there is no need to reset the app. This issue could also be worked around by adding a certificate selection menu to the settings.

📸 Screenshots

Manual tests I did

• Upgrade from main does not crash and old settings are still saved/available/used
• It is still possible to connect to server without mTLS
• A certificate can be selected and saved in the settings. Certificate is used for connections to the server
• Close the app and restart: Certificate setting has been persisted and connection is still using mTLS

Tested on Android 15 (Pixel 6) and Android 14 (Samsung Galaxy Note 20 Ultra 5G)

🦮 Reviewer guidelines

• 📝 I am not an Android dev and this is my first time with Kotlin and contributing to the Bitwarden project. While I have tried to follow the architecture, I'm sure I missed some things and and others are not in the right place. I apologize in advance and look forward how to improve the code
• ❓ The Android APIs use the key alias wording (KeyChain.choosePrivateKeyAlias), and this is also the wording I chose in the code. For the UI I chose to go with Client certificate. While this is generally bad to have two wordings for the same thing, key alias cannot be used in the UI because confusing for the user, and user certificate in code is kind of weird because that would be something else that the Android wording. Open for suggestions
• 🌱 Following the current approach, we can add a Certificate selection screen to the settings. This way it is not necessary anymore to reset the app to choose a new certificate.

[bitwarden-bot]

Thank you for your contribution! We've added this to our internal Community PR board for review.
ID: PM-16157

[vvolkgang]

👋🏾 Looking great, thanks for your contribution! We may only be able to action after the holiday season but have some preliminary questions:

1. Can you provide a screen recording of the user interaction?
2. Just to confirm, KeyChainCallback handles both choosing an existing system certificate or importing a new one to the system KeyChain correct?
3. Did you consider also support in-app importing to a KeyStore like it was done here? Mostly curious if you tried it and bumped into any issues but I understand it's a bigger lift that may not be needed for your usecase.
4. 💭 For system certificates we may need to store more than just the alias to reduce the surface of unintentional certificate swaps.

[rohm1]

Hey @vvolkgang ,

thanks for the quick feedback! To your questions:

1. Screen recording when user has a certificate installed. Clicking "select" will take the value, clicking "Deny" will clear the input box

screen-20241218-193902.mp4

Screen recording when no client certificate is installed. In this case Android displays nothing. To avoid confusing the user too much, I updated the description text.

screen-20241218-194202.mp4

2. Are your referring to Android's KeyChainAliasCallback or to my ChoosePrivateKeyAliasCallback (which is a wrapper for the Android object)? anyway, the current implementation can only choose a certificate that has previously been installed, no import
3. No I did no try to implement the in-app import. Should we update the description text to make it clear?
4. Do you mean certificates installed/managed by the system? As you can see in the screen recording, they are not available in the selection menu, so nothing more to do?

[agiUnderground]

Is anyone working on the same feature for iOS?

[Daniel-dev22]

Any progress on this? This would be a great enhancement.

[fooryo]

is there any ETA for the next version with this feature?

[Daniel-dev22]

is there any ETA for the next version with this feature?

@vvolkgang might know. Initially it was potentially going to be reviewed after the holiday season which I assume would be now?

[optimist555]

Eagerly waiting for this as mTLS is an important security feature for self hosted instances.

[seaside1]

Looking forward to this one.

[SaintPatrck]

Hi @rohm1

Thank you for getting this started! I'm going to begin pushing commits to your PR to match our patterns and guidelines. I'm going to reduce the scope a bit and extract some changes to separate pull requests so they're easier to review. If at any point you have questions or suggestions don't hesitate to let us know.

[github-actions]

Checkmarx One – Scan Summary & Details – bf8a657e-9fb7-4d9a-9288-d1597e94d0ff

Great job, no security vulnerabilities found in this Pull Request

[kuolemaaa]

dayum, can't wait