Closed
Conversation
Contributor
|
Label error. Requires exactly 1 of: changelog:.*. Found: 📱mobile. A maintainer will add the required label. |
andymule
added a commit
to andymule/immich
that referenced
this pull request
Dec 1, 2025
Security improvements: - Android: Certificates stored in Android KeyStore (hardware-backed when available) - Private keys never leave the KeyStore - More secure than storing raw bytes in app storage - iOS: Certificates stored in iOS Keychain - Widget extension support via shared Keychain access group Architecture improvements: - SSLHttpClient factory for unified SSL configuration - Compute isolate for certificate loading (no main thread jank) - Error display screen for initialization failures - Platform-aware certificate storage abstraction Features: - Full mTLS support for Android and iOS - iOS Widget Extension support (SSLURLSession) - User-installed CA certificate trust via network_security_config - Self-signed certificate bypass option (for trusted networks) For mTLS to work: 1. Install CA certificate on device - Android: Settings → Security → Install certificates - iOS: Install profile, then Settings → General → About → Certificate Trust Settings 2. Import client certificate (.p12) in Immich app settings 3. Connect to mTLS-enabled server endpoint Builds on PR immich-app#22768 concepts with improved security model.
andymule
added a commit
to andymule/immich
that referenced
this pull request
Dec 1, 2025
Security improvements: - Android: Certificates stored in Android KeyStore (hardware-backed when available) - Private keys never leave the KeyStore - More secure than storing raw bytes in app storage - iOS: Certificates stored in iOS Keychain - Widget extension support via shared Keychain access group Architecture improvements: - SSLHttpClient factory for unified SSL configuration - Compute isolate for certificate loading (no main thread jank) - Error display screen for initialization failures - Platform-aware certificate storage abstraction Features: - Full mTLS support for Android and iOS - iOS Widget Extension support (SSLURLSession) - User-installed CA certificate trust via network_security_config - Self-signed certificate bypass option (for trusted networks) For mTLS to work: 1. Install CA certificate on device - Android: Settings → Security → Install certificates - iOS: Install profile, then Settings → General → About → Certificate Trust Settings 2. Import client certificate (.p12) in Immich app settings 3. Connect to mTLS-enabled server endpoint Builds on PR immich-app#22768 concepts with improved security model.
Member
|
@denysvitali Please open a new PR when the implementation is stable. In its current form, it doesn’t address the underlying issue and contains significant implementation flaws, so we can’t proceed with it as is. |
10 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
As per #15230 - the mTLS support (and User-CA support) in Immich is rather poor.
This PR (DRAFT!) will fix these issues by integrating
ok_httpand using the Android trust store.Fixes #15230
This PR depends on two PRs opened at dart-lang/http:
How Has This Been Tested?
N/A
Screenshots (if appropriate)
Checklist:
src/services/uses repositories implementations for database calls, filesystem operations, etc.src/repositories/is pretty basic/simple and does not have any immich specific logic (that belongs insrc/services/)Please describe to which degree, if any, an LLM was used in creating this pull request.
Extensively. Mostly Z.AI GLM 4.6.