Ionic and client side certificates


#1

Hello,
I have an app working today with SSL self-signed as well as CA signed certificates. Everything works perfectly.

Some users have asked me to support client-side certificates in the app.

Does anyone have any tips or links on how to go about doing that in ionic/cordova and are there any gotchas?


#2

I have never done it in a mobile app, only between servers but one gotcha that seems obvious is how will you distribute the client certs, if it’s in the app then it’s like giving it to anybody who downloads the app.


#3

I remember seeing an article about this forever ago, I can not find it though. As far as I know you have to handle the http requests via the native code since I don’t think there’s a way to do it in javascript (at least a way that the platforms allow).

This came up in my search and it might give you some more information.


#4

Thank you @NorthMcCormick and @gmarziou

@gmarziou, I had assumed this client certificate would be shared post app install - for example as of today, if the server SSL certificate is self-signed, one needs to install the profile in the device (as simple as emailing the certificate to yourself and installing it in the phone). My assumption is there will be a similar approach for client certificates (which could be wrong)

@NorthMcCormick, thanks for that link. I did come across it in my initial research but as you have said, it was not a particularly reassuring thread :slight_smile: Given that it was 3 years ago, I was hoping this might have been addressed.