WebDAV Android SSL handshake error (self-signed)

[Tursu311]

Your Environment

• Version used: In-App: 7.13.2 APK, F-Droid version: 21.0 17/04/2023
• Operating System and version: Android 12 - LineageOS 19.1 MicroG version

Expected Behavior

When I put my server info for sync using WebDAV same as in .AppImage version, should sync my tasks with Nextcloud WebDAV directly as in desktop, maybe showing a pop-up to confirm SSL certificate is self-signed

Current Behavior

When I save my config, and press sync button, upper left screen appears a popup lower part of the screen: Unknown Sync Error: Error: Invalid response: -2 SL Handshake Error. It never syncs my tasks.

Steps to Reproduce (for bugs)

1. Use android app
2. Input WebDAV sync config for a Nextcloud self-signed instance
3. Save and press sync.

Can you reproduce this reliably?

Every time, tried different passwords, folders, and users for WebDAV.

Console Output

No idea to check on android

[github-actions]

Thank you very much for opening up this issue! I am currently a bit overwhelmed by the many requests that arrive each week, so please forgive me, if I fail to respond personally. I am still very likely to at least skim read your request and I'll probably try to fix all (real) bugs if possible and I will likely review every single PR being made (please, give me a heads up if you intent to do so) and I will try to work on popular requests (please upvote via thumbs up on the original issue) whenever possible, but trying to respond to every single issue over the last years has been kind of draining and I need to adjust my approach for this project to remain fun for me and to make any progress with actually coding new stuff. Thanks for your understanding!

[github-actions]

Hello there Tursu311! 👋

Thank you and congratulations 🎉 for opening your very first issue in this project! 💖

In case you want to claim this issue, please comment down below! We will try to get back to you as soon as we can. 👀

For more open ended discussions and/or specific questions, please visit the discussions page. 💖

[github-actions]

This issue has not received any updates in 90 days. Please comment, if this still relevant!

[gostaj]

Syncing using WebDAV against a server using a self-signed certificate works fine with the desktop app on a Mac.
But I'm having this problem myself in the Android app and would like to sync with my server having a self-signed certificate.
But looking at the code it looks "as designed" that it doesn't work in the Android app.

@johannesjo if I would create a PR for accepting invalid certificates in the Android app, would that be of interest?
I'm using Joplin for note syncing and it has a toggle for "Ignore TLS certificate errors", I'm thinking of something similar.
Or the Android app should work like the desktop app of Super Productivity that accepts self-signed certificates by default.

[Jagdfalke]

Syncing using WebDAV against a server using a self-signed certificate works fine with the desktop app on a Mac. But I'm having this problem myself in the Android app and would like to sync with my server having a self-signed certificate. But looking at the code it looks "as designed" that it doesn't work in the Android app.

@johannesjo if I would create a PR for accepting invalid certificates in the Android app, would that be of interest? I'm using Joplin for note syncing and it has a toggle for "Ignore TLS certificate errors", I'm thinking of something similar. Or the Android app should work like the desktop app of Super Productivity that accepts self-signed certificates by default.

PRs are always welcome! What you described is a very viable solution. I'm all for it.

[gostaj]

Great! But just to make things clear, do you know what makes the Super Productive Mac OS app accept self signed certificates for WebDAV?
I'm reading the code and have understood that you can pass a Node https agent using rejectUnauthorized: false (which the Jira integration does) to the webdav library to accept self signed certificates. But that doesn't seem to be used for webdav as far as I can see?

[johannesjo]

There is nothing similar implemented for WebDAV. Not a big fan of this workaround neither tbh, as it might confuse users that don't need it and opens up security vulnerabilities.

[gostaj]

I understand your concern @johannesjo but correct me if I'm wrong: The Super Productivity Mac OS app currently accepts self-signed https certificates, by default, over WebDAV sync without any errors.
(The Mac OS app successfully syncs against my WebDAV server that is using a self-signed certificate.)
But this is not possible today using the Super Productivity Android app where the "SSL handshake error" is seen.

My PR (if you want it) would be adding an option to the Android app, turned off by default, that accepts self-signed https certificates over WebDAV sync similar to the Joplin app:

Going forward I would suggest adding the same setting to the native apps and turning the setting off by default.

[johannesjo]

Can you maybe explain your use case to me? Since let's encrypt exists, it should not be difficult to get a valid certificate.

[gostaj]

Can you maybe explain your use case to me? Since let's encrypt exists, it should not be difficult to get a valid certificate.

Yes, I have a WebDAV account on a server with a self-signed certificate. Since I'm not the admin I cannot setup Let's encrypt. Syncing works fine, as I mentioned, using the MacOS app but not with the Android app.
Another option is of course to use HTTP but that is even less secure than HTTPS with a self-signed certificate.

I see your point with confusing users and opening up vulnerabilities. To me this would be an advanced setting for people knowing what they are doing, disabled by default and perhaps use the wording "not recommended".

Personally I love apps that are configurable and let me, the user, be the judge of which ways I want to sync my own data. I mean WebDAV over HTTP is supported and it is even less secure.

Having that said I really like and respect your project and won't bother you if you don't want this feature.

[johannesjo]

Thank you very much for the explanation. I think we would have to hide it in some sort of advanced settings section (same for Jira) and even than it is a little bit of extra clutter and code to maintain, so personally I'd lean towards not adding it at the moment. But I might change my mind, if this use case turns out to be more common than I expected :)

Sorry, about this and thank you very much for being so understanding!

[gostaj]

Totally understand, no problem.
Perhaps this thread is a bad place to aks but are there any other Android bugs/features you need help with?

[johannesjo]

Oh there is a lot of stuff that could and should be improved and help is always welcome! Generally I recommend working on something you care about personally, but there is also a list of issues tagged with android:
https://github.com/johannesjo/super-productivity/issues?q=is%3Aopen+is%3Aissue+label%3Aandroid

If you have some new feature you'd like to see, it's best to open up an issue about it first, so we can discuss the details.