can't connect to my ownCloud

[schiessle]

I'm running my ownCloud (stable5 git branch) over a SSL connection and have the latest news app from the Google Play Store. The certificate is signed by CACert.

If I disable "allow all SSL Certificates" in the app settings I get this error message:

hostname in certificate didn't match: <wolke.schiessle.org> != <*.schokokeks.org> or <schokokes.org> or <*.schokokeks.org

If I look at the certificate in my browser everything seems to be fine, the domain is wolke.schiessle.org and the certificate is issued for *.schiessle.org.

If I enable "allow all SSL Certificates" sync still doesn't work, it just shows an empty black rectangle where the error message was before.

[David-Development]

Thank you for reporting this issue. In the lastest version I've increased the security guidelines as described here: #44. So as you can see in the message your hostname and your certificate hostname does not match. The function "allow all SSL Certificates" should only be used if you have a self signed certificate.

So I think my app behaves correctly, right? @Raydiation @kampka

[schiessle]

@David-Development But why doesn't they match? You can go to wolke.schiessle.org by your own and look at the certificate with your web browser. The certificate is issued for *.schiessle.org and the domain is wolke.schiessle.org. The ownCloud mobile client is also able to connect to it flawlessly.

Is it because the certificate gets served from schokokeks.org? That's the provider who hosts my domain. If that's the case than this behaviour will break the app probably for almost all shared hostings. I don't think that this is the desired behaviour. You should at least bring such certificates to the attention of the user and let him decide if it is the correct certificate or not.

[kampka]

Taking a quick look at your server / domain setup seems to indicate that the server is expecting Server Name Indication to handle multiple SSL certificates behind one IP address. This is a feature that's currently supported in all major web browsers, however that HTTPClient library hasn't gotten around to this yet [1]. Thus I believe the app is performing as expected at this point.

@schiesbn It might be helpful to contact your hosting provider about this, maybe they can shed some light on the issue.

@David-Development You may want to consider switching HTTP clients to HttpUrlConnection because it's more advanced than the Apache client. It also seems to be the preferred way of doing HTTP in current versions of Android [2].

[1] https://issues.apache.org/jira/browse/HTTPCLIENT-1119
[2] http://android-developers.blogspot.de/2011/09/androids-http-clients.html

[David-Development]

@kampka Thank you for your help. Nice info btw. I'm trying to move to the HttpUrlConnection.
@schiesbn When I'm trying to access your domain, my chrome show me a warning that your cetificate does not match your hostname.
I hope this issue could be removed when I'm using the HttpUrlConnection.
Otherwise I've to implement a feature that you can disable the StrictHostnameVerification (strongly not recommend!).

[schiessle]

Chromium doesn't show such a warning on my system, maybe because I have imported the CACert root certificates?

Generally, did you had a look at the ownCloud mobile app how https connections are handled there? Maybe this could be helpful to solve this issue for the news app.

[David-Development]

Yes its because you imported the certificate. I'm going to take a look to the ssl implementation of the ownCloud android app soon. I hope I can get it working then.

[keithzg]

This breaks my own setup as well, as my Amazon EC2 instance's hostname as written in its Amazon-generated certificate (domu-AStringOfHexadecimalNumbers.compute.l.internal) is obviously not the address I'm connecting to it at. Admittedly the correct solution is for me to get myself a proper certificate, heh.

[schiessle]

@David-Development Did you had time to look at the ownCloud android app? Would be great if we could solve this issue.

BTW, will you attend the developer meeting this weekend in Berlin? Would be a great opportunity to talk to the developers of the ownCloud Android App.

[David-Development]

No, sorry I'm too busy imo. Btw. The App should still work for you because I had to turn off the security stuff when I changed from the Apache HttpClient to the HttpUrlConnection.
I took a quick look into the source code of the Android App but it was a lot of stuff and I don't know yet how to use it in my App.

Yes, I'm joining the developer meeting this weekend! :-)

[schiessle]

@David-Development great, after upgrading my server to the latest news app and appframework the android app works as expected! 😄

Looking forward to see you in Berlin!

[David-Development]

@schiesbn I've changed the SSL-Verification to "BROWSER_COMPATIBLE_HOSTNAME_VERIFIER" now in order to increase security. I hope it still works for you.

@davivel Thank you for the hint!

[schiessle]

@David-Development I will test it as soon as a package exists and report back.

[davivel]

@David-Development , hope it really helps. Let's see it!