ERR_BAD_SSL_CLIENT_AUTH_CERT

[rchovan]

I can't connect to Odata with ssl certificate authentification. We are using it with openUI5. Application is running as mobile (android) application.

OpenUI5 version: tested on 1.42.9, 1.44.9, 1.46.5

Browser/version (+device/version):
WebView/57.0.2987.132 (Android/5.1.1)

Any other tested browsers/devices(OK/FAIL):
Chrome(57.0.2987.132)/Android - OK

URL (minimal example if possible):

User/password (if required and possible - do not post any confidential information here):

Steps to reproduce the problem:

1. Connect oData to any web page which require SSL Client Certificate
2. Connection always fail with ERR_BAD_SSL_CLIENT_AUTH_CERT

What is the expected result?
It should show selection dialog with imported user certificates

What happens instead?
Error in console:
GET https://username:password@url/mpmt/MenuItemSet net::ERR_BAD_SSL_CLIENT_AUTH_CERT

Any other information? (attach screenshot if possible)

I tried several connection types on mobile device:
http is working good
https with optional certificate works good
https with required certificate Cannot access data

I also tried several connection types from browser:
http is working good
https with optional certificate works good
https with required certificate Can access data

[kineticjs]

Hi @rchovan,

What happens when you open the service URL of the OData service via the browser only,
(for example for the public Northwind OData service, the URL will be https://services.odata.org/V2/Northwind/Northwind.svc/)?

Thanks,
Diana

[rchovan]

When I open service URL in chrome browser on Android or PC, it shows dialog with certificates where I can choose the right one.

[kineticjs]

Hi @rchovan,
When you:
(1) accept a valid certificate at the above prompt (and as a result open the returned service content successfully) and then
(2) run the app with the same browser
does the error no longer appear?

[rchovan]

Tried, but It is not working, and it will not work, because android app uses WebView, and my default browser is Chrome.

But generally it should work, because certificate is imported to system, not to browser.

[rchovan]

@kineticjs Hi,
do you have any other questions ? Can I provide something else ? If not, could you please change tag to bug ?

Thank You.

[gerym]

Hi @rchovan

Can you please provide a small snippet of code or a jsbin example of "connecting" to OData.

Thanks & Kind Regards,
Gery (GitHub Dispatcher)

[rchovan]

@gerym Hi, I have example code here https://github.com/rchovan/openui5_issue_1441, but url, login and password for test I don't want to share publicly. Please, contact me by email (coudy at chovan dot net), and I'll sent you required access and certificate. You can test it with HTTP, HTTPS with optional certificate and HTTPS with required certificate.

Thank You.

[kineticjs]

Hi @rchovan,

So basically the problem appears on the mobile device only?
That is, if you run the same UI5 app on a desktop browser, you get prompted for a certificate and once you select the valid certificate, the app works successfully with the backend OData service?

Thanks,
Diana

[stephania87]

@rchovan, please check if the problem is still reproducible. If possible, check on other Android device and non-Android device, including a non-mobile device. Try changing the Internet connection and disabling any antivirus programs running in the background.
We will be waiting for your update.