Allow Self-Signed Certificates with WebDAV

[ddulic]

Please agree to the following

• I have searched existing issues for duplicates
• I agree to follow this project's Code of Conduct

Summary

Would like the option in settings to allow the use of self-signed certificates when connecting via WebDAV.

Motivation

Hello, currently, the mobile apps don’t allow me to connect locally to my NAS via WebDAV. I am using a self-signed certificate.

The following error shows up when attempting to connect to the WebDAV’s https endpoint.

I am not able to get something like Let’s Encrypt as I don’t wish to expose my NAS outside of my network for this.

My use-case is that I VPN into my home network if I need to access Cryptomator vaults. I am aware that this is not the use-case for the vast majority.

Considered Alternatives

I am able to use the http WebDAV endpoint without issue, and it isn’t much of a security risk as the http is still going over the VPN tunnel when I am outside of my local network.

Anything else?

Just a toggle in the settings to accept self-signed certificates that is disabled by default would be enough.

[tobihagemann]

Self-signed certificates are actually supported but it looks like it fails in your case with this error:

https://github.com/cryptomator/cloud-access-swift/blob/c9373ecb6b7d0dfe9041a71c32ddcd52d7716658/Sources/CryptomatorCloudAccess/WebDAV/TLSCertificateValidator.swift#L86

Unfortunately, logging doesn't exist in the TLSCertificateValidator so it's unclear to me where it fails exactly. Will have to investigate this further.

[ddulic]

One thing to note now that you mentioned that self-signed certificates are actually supported is that the default Synology certificate doesn't have a TLD extension, so it is accessed via https://synology:<port>.

Please let me know if there is anything I can help with.

[tobihagemann]

@ddulic Updated version is now live in the App Store. Please try again if this fixes your issue. If it doesn't, I guess I was wrong but at least we added error logging. In this case, please attach the log file or the error message.

[ddulic]

Hey @tobihagemann, thank you for the update!

I have updated the app, but it still isn't working. I am not getting an error now, but it is just hanging with the message "Authenticating...". This happens both if I try to change the current HTTP to HTTPS (logs attached below for that attempt) and if I try and add a new vault via HTTPS.

❯ ll | grep 01-19                                                
-rw-r--r--@ 1 ddulic  staff   1.2K 19 Jan 09:55 org.cryptomator.ios 2023-01-19--09-49-07-936.log
-rw-r--r--@ 1 ddulic  staff   301B 19 Jan 09:55 org.cryptomator.ios.fileprovider 2023-01-19--09-49-08-356.log
-rw-r--r--@ 1 ddulic  staff     0B 19 Jan 09:53 org.cryptomator.ios.fileprovider-ui 2023-01-19--09-53-31-573.log

❯ cat "org.cryptomator.ios 2023-01-19--09-49-07-936.log"
2023/01/19 09:55:10:087  Setting trialExpirationDate was removed
2023/01/19 09:55:10:088  Setting fullVersionUnlocked was written with value true
2023/01/19 09:55:10:088  Setting hasRunningSubscription was written with value false
2023/01/19 09:55:14:613  Setting trialExpirationDate was removed
2023/01/19 09:55:14:613  Setting fullVersionUnlocked was written with value true
2023/01/19 09:55:14:613  Setting hasRunningSubscription was written with value false
2023/01/19 09:55:21:910  Freemium version
2023/01/19 09:55:21:928  Setting trialExpirationDate was removed
2023/01/19 09:55:21:928  Setting fullVersionUnlocked was written with value true
2023/01/19 09:55:21:928  Setting hasRunningSubscription was written with value false
2023/01/19 09:55:22:437  Setting trialExpirationDate was removed
2023/01/19 09:55:22:438  Setting fullVersionUnlocked was written with value true
2023/01/19 09:55:22:438  Setting hasRunningSubscription was written with value false
2023/01/19 09:55:24:215  Setting trialExpirationDate was removed
2023/01/19 09:55:24:215  Setting fullVersionUnlocked was written with value true
2023/01/19 09:55:24:215  Setting hasRunningSubscription was written with value false

❯ cat "org.cryptomator.ios.fileprovider 2023-01-19--09-49-08-356.log"2023/01/19 09:53:30:141  enumerateItems getAdapter failed with: defaultLock for identifier: NSFileProviderItemIdentifier(_rawValue: NSFileProviderRootContainerItemIdentifier)
2023/01/19 09:55:25:435  Deinit called for Optional(<NSFileProviderDomain: 0x10400c9a0, C{9}r id=D{34}0 (enabled,syncTrash)>)

[tobihagemann]

I guess we indeed fixed the error but you're now experiencing a different issue. We'll discuss it over at #295.