5

On Android 10, with a .p12 client certificate installed (includes user key, user cert and CA cert), going to a URL in Chrome or FF that requests a client cert, the KeyChain does not prompt to select an installed cert to use. The KeyChain dialog flashes for a split second, but has no certs listed, and just goes to and error: ERR_BAD_SSL_CLIENT_AUTH_CERT.

This process works on Android 9 and below with the same .p12 without issue, along with Desktop browsers on various platforms, so the .p12 and Apache config for requesting the client cert would appear valid.

All I can find that might relate to a change in Android 10 is: https://developer.android.com/about/versions/10/behavior-changes-all#keychain

Unfortunately, it's unclear as to what might be required to change and whether it's something in the Apache config or in the .p12 itself.

Happy to provide more details if anyone has any ideas, rather than just dumping everything I can think of here from the start.

Amendment:

After much testing, it appears to be that Android 10 doesn't seem to like client certs issued by an intermediate CA cert.

Despite putting the full chain into the .p12 (root CA cert, intermediate CA cert and leaf cert), the KeyChain on Android 10 doesn't offer up the installed cert when a client cert is requested by a site.

The same root CA issuing a leaf cert with the same extension and attributes as above, then put into a .p12 (root CA cert and leaf cert) does then work.

Unfortunately, I need to use the intermediate to issue the leaf certs, but I've no idea why this doesn't seem to work just on Android 10! Unsure if this is a bug or something else specific is required to get it working.

I've also tried installing the Root CA cert and intermediate CA cert separately, as the "Trusted Credentials (User)", but it makes no difference.

Leaf cert extension attributes are:

keyUsage = digitalSignature
extendedKeyUsage = clientAuth

7
  • After much testing, it appears to be that Android 10 doesn't seem to like client certs issued by an intermediate CA cert. - I had to install the intermediate certificate in Android's trustStore too, so it was working as soon as I had all 4 things installed: Root CA Certificate, Intermediate Certificate, User key, User certificate (combined in one pfx with User key, CA and Intermediate as separate .pem files).
    – Johannes
    Sep 1, 2020 at 10:15
  • Nope, it has been cached somewhere. After opening a clean browser session, authentication didn't work when nginx had just the Root CA cert configured. When configuring the chain (root and intermediate) it works - but that's a configuration nightmare to have all intermediate certificates in the web server's trustStore...
    – Johannes
    Sep 1, 2020 at 13:17
  • Johannes, I installed the root CA cert and intermediate cert in "Trusted Credentials (User)" under Settings (then encryption/security off the top of my head) on Android 10. The .p12 package installed on Android 10 also had the root CA cert, intermediate cert and user/leaf cert, plus user/leaf key, but still this didn't work. The web server, Apache in my case, uses the RootCA cert to request the client cert from the client connecting. The web server shouldn't need an intermediate cert, as anything below the RootCA needs to be valid, i.e. any intermediate and any user/leaf cert.
    – Chris Seal
    Sep 2, 2020 at 11:11
  • @ChrisSeal did you get to the bottom of this? I'm facing the same issue now
    – DevNewb
    Jul 7, 2021 at 21:30
  • @DevNewb afraid not - it appears to be a legit bug that is resolved in Android v11. I’ve raised it with the Google Android developers: issuetracker.google.com/issues/166132182
    – Chris Seal
    Jul 8, 2021 at 22:18

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.