Be sure to read How to get debug information and open a proper issue to provide necessary logs and information.
Any issue without the logs can be automatically closed without further notice.
Issue description:
Although most of my multiple Kodi machines run on Windows, I also have some instanced on Android devices - which include out of the box the SSL setting for control connections. Yatse access to all of them via an internal domain I have created (not by IP address), something like “tablet.home.internal” or “PC1.home.internal”.
Some of these devices run other services (e.g. web servers) which are configured with SSL/TLS certificates. Although I know that nowadays there are “easier” alternatives (e.g. Let’s encrypt), this certificates’ infrastructure is 100% managed by me, from the root CA to each final one, and they work fine with every service where they are configured, no matter the client they are accessed from (after having added the root CA as a trusted one on such client). Therefore, I can browse a webpage hosted in a PC named “PC1.home.internal” using a final cert. linked to that domain (e.g. https://PC1.home.internal:8080/mywebpage) from a browser in my android tablet (with the root CA already added as trusted), and the browser won’t fail to validate the cert.
However this is not the case with Kodi (android server) and Yatse (client): Yatse fails when I configure the host (advanced tab) to go through HTTPS (if I click the “check” button it says “SSL error: Fix your proxy configuration or select HTTP as connection type”) and I have to pick the option “HTTPS (no cert checks)” to make it work.
This is not the first time I have had a problem with an Android client trying to connect to a service that uses a cert. of my own, and it’s due to the following: When you manually add a root CA cert. as trusted in Windows, it is added to the same repository where all other trusted root CAs are, and all the client apps in Windows automatically have access to it when checking a final cert. signed by it. However, Android has two different repositories: one for root CA certs. that come with the operating system, and another one for the ones created/managed by the user. By default client apps only access the system ones; if a client app (e.g. Yatse) is supposed to check in the user’s repository then the following is needed:
-
a configuration XML file (e.g. res/xml/network_security_config.xml) stating that, in addition to the system ones, user’s CA certificates can be checked in order to validate a final cert (check attached example)
-
a reference to that XML file in the AndroidManifest.xml for the networkSecurityConfig setting:
<application
android:networkSecurityConfig=“@xml/network_security_config”
…
…>
Logs:
Please let me know if the logs are really needed. e.g. if Yatse is already prepared to check in the user’s CA certs. repository, although based on my experience with other apps with identical issues that ended up being solved with this, and the fact that the option “HTTPS (no cert checks)” works, I am pretty sure it is not the case.
Screenshots:
Additional information:
network_security_config.xml.txt (562 Bytes)