I've set up a server that accepts HTTPS connections with a custom CA certificate. I've installed it on my Samsung Galaxy A50, and can now access the server without warnings in Chrome. Now, I'd like to limit access to clients authenticated with mTLS, where they submit client certificates.
So far, it works properly on desktop browsers, refusing a TLS connection when a client certificate isn't provided. I now need to access this on the Android phone.
I usually use Firefox on that phone, but Firefox does not support client certificates yet. Chrome does, however: when I access https://certauth.idrix.fr with the client certificate installed, the certificate choice popup does appear. It doesn't do that for my server, however: instead, it shows a
ERR_BAD_SSL_CLIENT_AUTH_CERT (WEBSITE didn't accept your login certificate, or one may not have been provided. Try contacting the system admin.), and doesn't prompt me to pick the certificate.
From my testing, the problem doesn't seem to be specific to my server: the same happens with mTLS configs for Nginx, Apache HTTPd, and Traefik. However, the https://certauth.idrix.fr server is somehow special, because the mTLS works for it.
How do I get Chrome to do this prompt? If I can't, what other browsers support client certificates? (It seems that very few do.)