starred/ntfy

Fork 0

mirror of https://github.com/binwiederhier/ntfy.git synced 2026-05-09 08:26:00 +02:00

[GH-ISSUE #87] Recognize imported ca certs in android #72

New issue

Closed

opened 2026-05-07 00:19:31 +02:00 by BreizhHardware · 7 comments

BreizhHardware commented

2026-05-07 00:19:31 +02:00

Owner

Originally created by @ki9us on GitHub (Jan 6, 2022).
Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/87

Feature request for the android app. I'm self hosting my ntfy instance and want to use my self-signed cert. The custom CA cert is imported in my Android OS... some apps recognize it and some don't. I request that ntfy trusts these user-imported CAs. I imagine they are easily accessible from the android SDK and/or your HTTP request library.

Originally created by @ki9us on GitHub (Jan 6, 2022). Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/87 Feature request for the android app. I'm self hosting my ntfy instance and want to use my self-signed cert. The custom CA cert is imported in my Android OS... some apps recognize it and some don't. I request that ntfy trusts these user-imported CAs. I imagine they are easily accessible from the android SDK and/or your HTTP request library.

BreizhHardware

2026-05-07 00:19:31 +02:00

closed this issue
added the
android-app

enhancement
labels

BreizhHardware commented

2026-05-07 00:19:31 +02:00

Author

Owner

@ki9us commented on GitHub (Jan 6, 2022):

The errors I get with my server are like this:

java.security.cert.CertPathValidatorExecption: Trust anchor for certificate path not found.

@ki9us commented on GitHub (Jan 6, 2022): The errors I get with my server are like this: ``` java.security.cert.CertPathValidatorExecption: Trust anchor for certificate path not found. ```

BreizhHardware commented

2026-05-07 00:19:31 +02:00

Author

Owner

@ki9us commented on GitHub (Jan 6, 2022):

I looked into it...

By default, secure connections (using protocols like TLS and HTTPS) from all apps trust the pre-installed system CAs, and apps targeting Android 6.0 (API level 23) and lower also trust the user-added CA store by default.

https://developer.android.com/training/articles/security-config#CustomTrust

So I guess user-added CA certs are not trusted by default anymore. Seems like you can re-trust them by creating this network_security_config.xml file and referencing it in your manifest.

<?xml version="1.0" encoding="UTF-8" ?>
<network-security-config>
    <base-config cleartextTrafficPermitted="false">
        <trust-anchors>
            <certificates src="user"/>
            <certificates src="system"/>
        </trust-anchors>
    </base-config>
</network-security-config>

According to https://stackoverflow.com/a/60102517/3006854

I'd be happy to test this fix on my custom CA certs but I don't have all the android build tools and don't want to install them (I know it's a heavy environment). However, if you send me an .apk I will test it for you.

@ki9us commented on GitHub (Jan 6, 2022): I looked into it... > By default, secure connections (using protocols like TLS and HTTPS) from all apps trust the pre-installed system CAs, and apps targeting Android 6.0 (API level 23) and lower also trust the user-added CA store by default. https://developer.android.com/training/articles/security-config#CustomTrust So I guess user-added CA certs are not trusted by default anymore. Seems like you can re-trust them by creating this `network_security_config.xml` file and referencing it in your manifest. ```xml <?xml version="1.0" encoding="UTF-8" ?> <network-security-config> <base-config cleartextTrafficPermitted="false"> <trust-anchors> <certificates src="user"/> <certificates src="system"/> </trust-anchors> </base-config> </network-security-config> ``` According to https://stackoverflow.com/a/60102517/3006854 I'd be happy to test this fix on my custom CA certs but I don't have all the android build tools and don't want to install them (I know it's a heavy environment). However, if you send me an `.apk` I will test it for you.

BreizhHardware commented

2026-05-07 00:19:31 +02:00

Author

Owner

@binwiederhier commented on GitHub (Jan 6, 2022):

Tested with a self-signed CA and certs in the emulator: github.com/binwiederhier/ntfy-android@54dd90d415

It was quite difficult to generate all of those, but it works. The one thing to note is that it didn't work with an internal IP address. It had to be a hostname. I used 10.0.2.2.nip.io which resolves to 10.0.2.2 for testing, but in your setup, you probably should have a real DNS server.

I'm closing this. It'll be in the next release, which will be a week or so I think. Until then you can probably use HTTP :-D

Thank you for resporting this and that's for pointing me in the right direction!!

@binwiederhier commented on GitHub (Jan 6, 2022): Tested with a self-signed CA and certs in the emulator: https://github.com/binwiederhier/ntfy-android/commit/54dd90d415dda9f066cb4680bab79bfed24e9433 It was quite difficult to generate all of those, but it works. The one thing to note is that it didn't work with an internal IP address. It had to be a hostname. I used 10.0.2.2.nip.io which resolves to 10.0.2.2 for testing, but in your setup, you probably should have a real DNS server. I'm closing this. It'll be in the next release, which will be a week or so I think. Until then you can probably use HTTP :-D Thank you for resporting this and that's for pointing me in the right direction!!

BreizhHardware commented

2026-05-07 00:19:31 +02:00

Author

Owner

@ki9us commented on GitHub (Jan 6, 2022):

You mean... you couldn't get the cert to work with an ip, even if you set it in the server certificate's Subject Alternative Names? Something like:

...
[SAN]
subjectAltName=DNS:mydomain.tld,IP:10.0.2.2

In the CSR should allow a self-signed cert to work for both https://mydomain.tld and https://10.0.2.2. I have domain-/hostnames so it doesn't affect me, but I feel like it should work.

If the android sdk doesn't support it, however, what can you do? 🤷

@ki9us commented on GitHub (Jan 6, 2022): You mean... you couldn't get the cert to work with an ip, even if you set it in the server certificate's Subject Alternative Names? Something like: ``` ... [SAN] subjectAltName=DNS:mydomain.tld,IP:10.0.2.2 ``` In the CSR should allow a self-signed cert to work for both `https://mydomain.tld` and `https://10.0.2.2`. I have domain-/hostnames so it doesn't affect me, but I feel like it _should_ work. If the android sdk doesn't support it, however, what can you do? 🤷

BreizhHardware commented

2026-05-07 00:19:32 +02:00

Author

Owner

@binwiederhier commented on GitHub (Jan 6, 2022):

Ohhhh there is an IP: field. Yeah i didn't do that. I mean it should work. If you want I can build you an APK and you can try it.

@binwiederhier commented on GitHub (Jan 6, 2022): Ohhhh there is an IP: field. Yeah i didn't do that. I mean it should work. If you want I can build you an APK and you can try it.

BreizhHardware commented

2026-05-07 00:19:32 +02:00

Author

Owner

@ki9us commented on GitHub (Jan 6, 2022):

Nah. If DNS: works, IP: should also work. Or else it's android's fault anyway.

@ki9us commented on GitHub (Jan 6, 2022): Nah. If `DNS:` works, `IP:` should also work. Or else it's android's fault anyway.

BreizhHardware commented

2026-05-07 00:19:32 +02:00

Author

Owner

@ki9us commented on GitHub (Jan 23, 2022):

Working in v1.6.0

@ki9us commented on GitHub (Jan 23, 2022): Working in v1.6.0