On Android 10, with a .p12 client certificate installed (includes user key, user cert and CA cert), going to a URL in Chrome or FF that requests a client cert, the KeyChain does not prompt to select an installed cert to use. The KeyChain dialog flashes for a split second, but has no certs listed, and just goes to and error: ERR_BAD_SSL_CLIENT_AUTH_CERT
.
This process works on Android 9 and below with the same .p12 without issue, along with Desktop browsers on various platforms, so the .p12 and Apache config for requesting the client cert would appear valid.
All I can find that might relate to a change in Android 10 is: https://developer.android.com/about/versions/10/behavior-changes-all#keychain
Unfortunately, it's unclear as to what might be required to change and whether it's something in the Apache config or in the .p12 itself.
Happy to provide more details if anyone has any ideas, rather than just dumping everything I can think of here from the start.
Amendment:
After much testing, it appears to be that Android 10 doesn't seem to like client certs issued by an intermediate CA cert.
Despite putting the full chain into the .p12 (root CA cert, intermediate CA cert and leaf cert), the KeyChain on Android 10 doesn't offer up the installed cert when a client cert is requested by a site.
The same root CA issuing a leaf cert with the same extension and attributes as above, then put into a .p12 (root CA cert and leaf cert) does then work.
Unfortunately, I need to use the intermediate to issue the leaf certs, but I've no idea why this doesn't seem to work just on Android 10! Unsure if this is a bug or something else specific is required to get it working.
I've also tried installing the Root CA cert and intermediate CA cert separately, as the "Trusted Credentials (User)", but it makes no difference.
Leaf cert extension attributes are:
keyUsage = digitalSignature
extendedKeyUsage = clientAuth
After much testing, it appears to be that Android 10 doesn't seem to like client certs issued by an intermediate CA cert.
- I had to install the intermediate certificate in Android's trustStore too, so it was working as soon as I had all 4 things installed: Root CA Certificate, Intermediate Certificate, User key, User certificate (combined in one pfx with User key, CA and Intermediate as separate .pem files).