Repository navigation
🔑 Use SSL Client Certificate to improve security #847
Description
Expected behaviour
Option to configure a Nextcloud account to include an SSL User's Private Key and Certificate to connect to the server.
The use of an SSL Client certificate greatly improves the security. It protects the SSL connection against SSL decryptors deployed here and there and many other threats. It also improves the security in the mobile device by moving the private key to a memory space where nothing can touch it.
As a first step, it should be easy to add this as an extra option to account but still require the password or the access token. In a further release, it would be possible to use the certificate as the only authentication but that requires more effort and more config in the SSL engine facing the Nextcloud service as well as in the Nextcloud config itself to map certificates names to usernames.
Actual behaviour
To use such a client side certificate is not an option as of now
Steps to reproduce
N/A
iOS version
N/A
App version
Latest
Server configuration
N/A
Operating system:
N/A
Web server:
N/A
Database:
N/A
PHP version:
N/A
Nextcloud version: (see Nextcloud admin page)
N/A
Metadata
Metadata
Assignees
Type
Projects
- Status
- Status
Activity
suunkie commentedon Apr 29, 2019
+1
Yeah i like to have that too.
cecom commentedon Jun 3, 2019
+1 😁
fhoner commentedon Oct 19, 2019
+1
renini commentedon Jan 31, 2020
This would definitely be great option to improve security
binlab commentedon Apr 7, 2020
TLS client certificate is a powerful feature to improve security and add addition factor to it
alexswerner commentedon Apr 12, 2020
+1 here.
I tried and added my client certificate to the ios certificate store, but this does not seem to be sufficient. After adding the certificate safari can access the server, but the Nextcloud client reports:
Connection error: The network connection was lost. Without the client certificate this setup works.pellaeon commentedon Aug 16, 2020
According to Apple documentation, apps have to write their own code to import SSL client certificates. It also outlines how to implement the feature. Hope to see support for this.
boombata commentedon Jan 18, 2021
+1
Would be very nice to have this feature for IOS ( also for Android and Windows clients :) )
tdotu commentedon Feb 12, 2021
+1
lfdla commentedon Feb 14, 2021
+1
aniqueta commentedon Mar 4, 2021
Came here searching for this, and so adding another vote. I know this is sadly a problem with iOS and Apple's design decision to not allow apps to access the system keychain. Appreciate any time spent on a workaround.
binlab commentedon Mar 4, 2021
@marinofaggiana could you please look at this issue? A lot of voting for this. Since this possibility is implemented into the Desktop Nextcloud Сlient and provides a considerable enterprise level of additional security, also prevents any brute-force attacks to Nextcloud endpoint by the application level and provides protected access on the network level. Nowadays, an alternative solution for providing the same level of security is using a VPN tunnel (such as OpenVPN by certificates access), which is much less convenient on mobile devices.
jogalt commentedon Apr 20, 2021
Ditto to this request. Multi factor Auth with trusted PKI is the only great way to bump security exponentially.
marinofaggiana commentedon May 13, 2021
Hi all, I'm doing some tests in development, who wants to participate?
jogalt commentedon May 13, 2021
I'm in.
74 remaining items
mpivchev commentedon May 9, 2025
Hi, thanks for pointing out the issues. This will be investigated.
ne20002 commentedon May 10, 2025
Now that this issue is on the list again I give a short description of what I would expect:
As said, mTLS (providing client certificate when asked by the server) is working with the Android client and Firefox on Linux. Due to the problems with the iOS client I had only time to do some basic checks on mTLS as I can't enable it permanently as it gives problems with the iOS client (even though I have only one user with an iOS client).
mTLS on the server can be configured required or optional.
if the server requiers the certificate, ask choose the certificate. If certificate can't be chosen or the certificate is rejected by the server give an error message with the option to cancel the connection to server completely. Maybe mark the connection as disabled, do not delete the user login data as the user might just install the certificate afterwards and want to retry. Maybe add a 'retry connection' option to login page for this purpose.
if the certificate is optional check for certificate on iOS device.
a) If none is found matching the server's name just continue with the connection. Do not pop up any error message.
b) If one is found with the server's name ask user if this is the certificate to use and if user chooses ok try to connect. If connection fails return to popup again asking for certificate so user can choose another certificate or cancel. If user cancels, go on with connection without using certificate.
If user has chosen a certificate and connection works store this decission and don't ask for new certificate as long as connecting with the certificate works. Otherwise just start over as described here.
Also consider that a mTLS user certificate may not be signed by a CA, it might be self signed or signed by a private CA.
I think that's it.
Klink0v commentedon May 18, 2025
@ne20002
I can't be 100% sure, but I remember that IOS does not support modern PKCS12 private key encryption. So, if you use p12-files to transfer mTLS certirficates onto IOS device, just check that you are using legacy PKCS12 format with RC2-40 private key encryption algorithm. There is the option "-legacy" for openssl, for example.
ne20002 commentedon May 19, 2025
@Klink0v You're right with that but I'm already using legacy created certificates. The Nextcloud iOS app just have its issues with mTLS certificates not handled properly.
shoaibomar commentedon Dec 6, 2025
Hi, I’m following up on this issue, which has been open for several years. Given Nextcloud’s extensive use in corporate environments, support for this feature seems like a fundamental requirement.
Could you provide any update on whether this is planned for an upcoming release, or if there are recommended workarounds in the meantime? Any guidance would be greatly appreciated.
mpivchev commentedon Dec 8, 2025
Hi, there is something in the works for importing mTLS certs: #2975 (comment)
A draft PR is here: #3685
Please test 7.1.8 (12) in Testflight, as it's an improved implementation of mTLS support.
joutain commentedon Feb 27, 2026
I don't think iOS support app utilizing the system keychain that you imported as a user certificate. But the app need to have it's own space/storage to import the certificate and use it. That's how @immich make it work with the iOS app. safari as a system app should be able to visit your next cloud instance but not for all the other apps. Android has some different implementation that will allow you to access the imported certificate to the system settings.
mpivchev commentedon Mar 2, 2026
@joutain this is what we do as well.
joutain commentedon Apr 21, 2026
Any news on this topic? I tried the latest 33.0.6 and it gave me the loop of choosing certificate file/type in password