TLS Client certificate Server is not reachable about immich HOT 15 CLOSED

We found the root cause and the issue will be fixed soon.

Thanks all involved for reporting issues and @alextran1502 for quick test.

from immich.

@pedropombeiro thanks for your kind help offer. The currently we are still in investigation stage by doing some internal tests. We will let you know if we need help.

from immich.

Thanks @yjiang-c for implementing this mechanism ❤️

from immich.

@yjiang-c Do you have any thoughts on this?

from immich.

What is the command to generate client certificate? As I know, you need -legacy option in OpenSSL command to generate client certificates for iOS

from immich.

What is the command to generate client certificate? As I know, you need -legacy option in OpenSSL command to generate client certificates for iOS

Yes, I know, I used the -legacy option. It's also possible for me to add the certificate on iOS natively.

from immich.

I'm seeing the same issue, and I'm able to access the site through Safari on iOS after having imported the certificate in the system.

from immich.

Thanks for your reporting. I can confirm that the issue is reproduced on iOS but not on Android. Based on my debug log on server side, the client does not send certificate to server.

I will investigate the issue. BTW, is there anybody produce this issue on older iOS versions before 17.5.1?

from immich.

Based on log analysis, I cannot find any wrong with my code. In addition, the issue is not reproducible on Android client, I suspected it should be problem on dart library.

I raised an issue to dart http group for more investigation. dart-lang/http#1277

from immich.

After looking at source code of dart sdk source code, I suspected that SecurityContext::useCertificateChain has wrong or outdated documentation. If that is case, the fix should be very simple.

@alextran1502 Since I have no development/test environment for iOS app, is there any way for you run test internally to check whether the issue could be solved by a patch I am going to propose? Thanks!

from immich.

@yjiang-c can you walk me to how to set it up for testing? I can help you test

from immich.

@alextran1502 If you like, you can follow this web page https://docs.nginx.com/nginx-management-suite/admin-guides/configuration/secure-traffic/ to setup nginx and generate client certificate, but it may need some learning curve if you have never done it before.

Another option is that I can email you my client certificate file and URL of my immich server. You just need to run iOS app to check whether you can got immich login page after logout.

Which one do you prefer?

from immich.

@yjiang-c the second option sounds easier, let's do that. I won't be able to get around this until late tonight or early tomorrow

from immich.

@alextran1502 Thanks a lot for your quick reply. I just emailed you about my immich URL and corresponding client certificate. Please let me know if you did not receive it. Thanks!

from immich.

If it is helpful, I can also help test the app, as I already have the proxy server and certificate configured, in case there's a beta version available for testing.

from immich.