5

I support a web-application that requires an https connection with client certificates as part of the authentication scheme. On most browsers (Desktop clients, iOS Safari, etc) if you are prompted for a client certificate and select a valid one the browser remembers this selection for future connections attempts.

Unfortunately, this isn't the default behavior of Android's Chrome. Every time the Chrome instance leaves memory (or maybe after some timeout) it shows the certificate selection dialog again.

This isn't something our users like and I would like to be able to tell Chrome how to remember the selected certificate for a given domain.

I've noticed this question asked every once and a while across the Internet, even here on the Android Stack Exchange site. Unfortunately, I've yet to see an answer to this problem, but I suspect someone out there has solved this already.

I'm looking for any effective solutions. Some things I've seen and tried to research:

Adding a policy -- such as the Automatically Select Client Certificate for These Sites which sounds promising but doesn't explain how to actually set this. There doesn't seem to be an analog to this if you visit chrome://policy in Android

  • I believe the above website is aimed at MDM / remote device management, but that isn't something that we can access here. Instead, I want to be able to set a one-off policy with for a phone that I have been given access to.

  • There are even posts about setting this policy on StackOverflow but they deal with desktop versions and I cannot seem to find someone whose done this for Android.

I'm also open to any solutions that involve wrapping a WebView or Chrome instance in an Android app that then programatically handles supplying the certificate.

  • The problem with this is that it seems as if WebView disables all JavaScript interaction and is a bit more "read-only" which isn't acceptable
  • I haven't seen an example of someone creating an app that starts a Chrome instance and is able to intercept anything like client certificate management for Chrome.

Thanks for any help.


EDIT: I thought that WebView doesn't allow Javascript (because Google states that in their docs. But they say by default and proceed to explain how you can write something for WebView that does in fact enable Javascript:

webView.getSettings().setJavaScriptEnabled(true);
webView.getSettings().setDatabaseEnabled(true);
webView.setWebChromeClient(new WebChromeClient());
webView.setWebViewClient(new WebViewClient() {
    @Override
    public void onReceivedSslError(WebView view, SslErrorHandler handler, SslError error) {
        handler.proceed();
    }

    @Override
    public void onReceivedClientCertRequest(WebView view, ClientCertRequest request) {
        // TODO: Supply the client certificate
        request.onProceed(privateKey, certificates)    
    }
        });
webView.loadUrl("https://some.app.url");

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.