Late warning when "distrust system certificates" checked

[ploink]

The letsencrypt certificate on my server was renewed using automated script, server restarted. Two days and a few hours later I got the security popup from davx5 "Please review the certificate".
Using Davx5 4.4.0.1-ose

I verified from the logs that the server (apache used as proxy to provide ssl for local radicale dav server) restarted after renewal and has not restarted or reloaded since. The old certificate was deleted after successful renewal but I checked my backup and it is still valid for 3 more days.
I remember same issue has happened after previous renewal.
Could this be a security bug?

[sunkup]

Sorry, I don't understand. What do you think should be a bug?

Please have a look here as well:
https://www.davx5.com/faq/synchronization/why-is-my-tls-certificate-not-accepted

[ploink]

The bug is: Why does davx5 generate a warning more than two days after the event? It should warn IMMEDIATELY.

If I remember correctly, previous time was much longer than two days, more like a week or so.
I have checked the "distrust system certificates" option months ago, did not work when it was needed, warned two days too late. The warning came at the moment when I hit the refresh button on my TODO agenda app widget.

I mean, if there is a security event, say a burglary going on, you are not going to schedule in your agenda for next week to call the police. You call 911 immediately.

DavX5 is syncing at regular intervals so it must have encountered the new cert very shortly after renewal yet remained silent.
I am just guessing here, but perhaps DavX5 is checking a cached certificate and not the latest version? Or perhaps it only generates the warning when you sync manually and not with scheduled syncs?

I could do some more testing if you want, forcing another cert renewal.

[sunkup]

Thank you for clarifying.

I have looked into it and for me DAVx5 complains immediately at the next connection attempt after the certificate has changed.

DavX5 is syncing at regular intervals so it must have encountered the new cert very shortly after renewal yet remained silent.

Maybe DAVx5 was unable to sync due to aggressive battery saving behaviour or missing/undetected internet connection (when using a VPN)?

I could do some more testing if you want, forcing another cert renewal.

If you can reliably reproduce the behaviour, please send us verbose logs and we can dive deeper. 👍

[ploink]

Hi @sunkup, thanks and sorry for not replying last year.

I do have some additional info:

When the security notification appears, it disappears on its own after several minutes or so. It does not appear again even when I force a manual sync, not until after a reboot or app force-stop/restart.

Likely the notification did initially appear after a certificate change but I just missed it. If it pops up at night for just a few minutes I am never gonna notice it. I think this is the core issue but I am not sure if it is my phone or DAVx5 that disappears the notification.

The "verbose logging" notification does not disappear and no notifications from other apps ever auto-disappear.
I am using crdroid (Lineage OS Android 13 based) with the app battery optimization disabled.

Any ideas?
Thanks.

[ploink]

If I do nothing, or only view the notification without making any decision it disappears in 60 seconds, reproducible.

Yes that's by intention for two reasons

1. These notifications often occur when the device connects to a WiFi with captive portal (Login button), but the user doesn't look at the device and at some time leaves the WiFi. In this case the notification would stay forever and when the user then looks at the device, they would see a quite random notification about a problem that doesn't exist anymore.
2. The TLS connection also times out at some time. It doesn't make sense to open a TLS connection, ask the user for verification and then to continue after 10 minutes because the connection would already be timed out. (The decision would be valid for future connections of course).

So to see the message again, you can either choose the "Reset certificates" entry in DAVx5 or force the app to be killed. Then the notification will appear one time.

So that exactly describes the problem then. I can understand reason number 1 but definitely not 2.

You notify the user for just 60 seconds in the middle of the night about an automated certificate renewal and then never again until reboot?

Just in case I was asleep and unaware of that notification being there between 2:02am and 2:03am, I would remain completely oblivious to the fact that DAVx5 no longer syncs. Only after a reboot for some other reason I might catch the next notification and my agenda may be a week out of date by then.

[rfc2822]

You notify the user for just 60 seconds in the middle of the night about an automated certificate renewal and then never again until reboot?

Just to understand your usecase: Why do you get a notification when the certificate is renewed? Are you using the Distrust system certs feature?

[ploink]

Are you using the Distrust system certs feature?

Yes I have mentioned that a few times including in the issue title.
I could just disable the option and ignore the issue but I thought I could help by reporting it. It is a nice feature that could help improve security if it worked properly.

[rfc2822]

Ah yes. It's probably time to refactor cert4android anyway. We will keep this in mind!

[ploink]

Thanks @rfc2822 and also @sunkup for all the great work you are doing with DAVx5! It is a very useful and important app. I will mark this as an answer.
FWIW, here some idea of how I think it may work:

• If an unknown/untrusted cert is encountered, show the warning notification without any timeout. Do not let the sync process wait for user input but just terminate the connection attempt.
• When user accepts the cert, clear the notification and retry the sync.
• When user rejects the cert, clear notification, store the decision and do not retry until next sync is due.
• Listen for any network status changes. When a change occurs (i.e. (dis)connecting wifi), clear the notification and sync if applicable. This would cover the captive portal issue.
• Currently, after user mistakenly rejects a valid cert, sync stops working completely without any indication. A manual sync seems to be successful because the thin orange line at the top of the account tile is not there but imho should be there.
• It may also be useful to have an option to review the last sync status for any account, something similar to the little lock icon next to the URL in a web browser. Tapping the lock may show some info about the connection, like hostname, ip, certificate/security info and success/failure information. From there the user could opt to review and change the accept/reject decision.

[sunkup]

Thank you for your commitment. We will keep the idea in mind 👍