Self-signed certificates

General
1

How can I import a self-signed certificate into SFOS (the CA one so that my certificate on my home server gets recognized as valid from a trusted CA)? And do I need to do that double on SFOS and AAS side?

My Nextcloud (just running in my local network) server has a self-signed cerificate, I managed to get iOS and Android devices working with that, but struggle with SFOS devices now.

SFOS works mostly even with that certificat, just Backup says it cant connect to the server since I switched to https. So I believe the reason is tbe self-signed certificate as especially the backup doesnā€™t seem to trust that connectionā€¦

2

ā€˜update-ca-trust extractā€™ (after droppig the cert in /etc/pki/ca-trust/source/anchors/) should work

6 Likes
3

Hm. Did it that way, can find the certificate under the section in settings, but browser still doesnā€™t trustā€¦

1 Like
4

See if this works

certutil should be part of nss-tools package

1 Like
5

SfOS has the trust command so ā€œ3.3. Arch and Fedoraā€ of above article should apply.

I take it you know this certificate to work in other situations, when you manually trust it?

6

@Cryx what Worked for me to Import a Self signed certificate into SFOS Browser:

Remark: My usecase was Not the CA but the Client cert and i have Not Tested the Flow Witz current Version 5.1 and Above:

7

Iā€™m not quite sure what you mean exactly. Maybe Iā€™m doing a step to much.

I know this gets a bit off-topic from SFOS, but Nextcloud password (AAS) apps, iOS/macOS CalDAV and CardDAV (and maybe other iOS Nextcloud apps like passwords) need a secure connection via https. As my Nextcloud isnā€™t configured to work from external connections and is only accessible from inside my home network I need a self-signed certificate for this. Also SFOS backup to that nextcloud now works again (certificate on the server was wrong before and didnā€™t match the CA) - so backup works without ssl or with correct ssl, while regular sync respects the ignore ssl problems in account settings.

So Iā€™m not sure after your comment if I really need the root cert to trust the certs from my own CA or if there is an easier way to get that trust. Sailfish browser still complains no trust, offered me to download the certificate and chain (which I somehow accidently installed by tapping them, but that cert manager seems to be AAS connected?), and Vivaldi browser on AAS side accepts it without problems now. So if thereā€™s an easier way Iā€™d be thankfull for additional hints (maybe even as pm and in germanā€¦)

8

Im new to this topic, but i dont really get what you actually want.

  1. Do you want the browser to allow you to connect to the NC interface via http instead of https?
  2. Do you have Apps installed on Android App support that you want to connect to your (local) NC?
  3. Do you have SailfishOS NC apps that cant connect to your NC?

or did you setup your NC to use SSL (https) even in your local network (also why in that case xD)?
Also you you self sign your certificates or do you use an external service like Lets Encrypt?

9

Hereā€™s my guide on how to add a selfmade CA to the various trust lists:

https://gitlab.com/nephros/harbour-privoxy/-/blob/master/docs/Userguide_HTTPS.md

It is aimed to enable Privoxy MITM, but the commands are generic.

And yes, the Browser has its own stores (nss) from the generic system CA store.

In case you use CACert to sign your certificates, you may try this:

Using a completely standalone self-signed cert will probably always make the browser complainā€¦

1 Like