[PR #1692] [Enhancment] Implimented mTLS user certificate for Android #1664

New Issue

2026-04-25T00:00:28+02:00

adam commented

2026-04-25 00:00:28 +02:00

📋 Pull Request Information

Original PR: https://github.com/advplyr/audiobookshelf-app/pull/1692
Author: @Jnewbon
Created: 9/23/2025
Status: 🔄 Open

Base: master ← Head: mTLS-KotlinClientUpdate

📝 Commits (3)

ebf5ad6 got mTLS user cert selection and persistence alongside the server connection details as a read only field
3ed7c52 Update API handler to seperate client builder into own class that also handles TLS config and rebuild when set
85157f0 Updated the HttpClient with a builder and added a download client with JIT instantiation

📊 Changes

12 files changed (+338 additions, -47 deletions)

View changed files

📝 android/app/src/main/java/com/audiobookshelf/app/MainActivity.kt (+2 -0)
📝 android/app/src/main/java/com/audiobookshelf/app/data/DeviceClasses.kt (+2 -1)
📝 android/app/src/main/java/com/audiobookshelf/app/managers/InternalDownloadManager.kt (+2 -3)
➕ android/app/src/main/java/com/audiobookshelf/app/plugins/AbsCertificate.kt (+32 -0)
📝 android/app/src/main/java/com/audiobookshelf/app/plugins/AbsDatabase.kt (+8 -2)
📝 android/app/src/main/java/com/audiobookshelf/app/server/ApiHandler.kt (+54 -35)
➕ android/app/src/main/java/com/audiobookshelf/app/server/HttpClientProvider.kt (+75 -0)
➕ android/app/src/main/java/com/audiobookshelf/app/server/MtlsOkHttpClientFactory.kt (+103 -0)
📝 components/connection/ServerConnectForm.vue (+37 -4)
➕ plugins/capacitor/AbsCertificate.js (+14 -0)
📝 plugins/capacitor/AbsDatabase.js (+7 -1)
📝 plugins/capacitor/index.js (+2 -1)

📄 Description

Brief summary

Implementation of Mutual TLS support on the Android platform

Which issue is fixed?

Resolves #1419
Resolves #353

Pull Request Type

Affects Android, Both front and back end

In-depth Description

My plans as it stands is,

Build UI Client cert selector for each server
- Select a cert per server
- Edit a cert for existing servers
Update Kotlin API to make use of the selected cert
- Separate the client builder and encapsulate mTLS usage
- Redirect API calls into this new builder
- Add plugin to accept request form frontend and route them through the new builder
- Tested that this actually works
Update the VUE components to make use of the cert
- Isolate all http calls into a central class
- Add logic to detect if call can be redirected into the backend
- Add ability to execute calls should backend not exist

1. UI Selection

That was a bit of a failed investigation, the SSL handshake in mTLS pipeline should allow for the server contacted to request the client (App) to send its user cert prompting the app to pop up a dialog listing installed certificate to choose from during the connection process. This would be an ideal situation as no extra UI would be needed, if the server needs a cert the user is prompted for on automatically

Sadly documentation for mTLS heavily favours hard-coded cert and keys where the app developer provide their own server and only want verified apps to be able to communicate with their server. i have been unable to find a way of getting the process to be automated thus have fallen to the backup of getting the user to manually select a cert when setting up the server connection.

ScreenShot

2. Kotlin API

Updating the Kotlin code to use mTLS based on a pre-selected certificate is well documented, so implementing this wasn't overly difficult, the main issue is ensuring that all calls in the Kotlin code based is routed via a client that has the mTLS certificate set. While this code is mostly done i haven't been able to test it properly due to the next section.

3. VUE API

The app is split in two, Kotlin and vue, both have their own client that independently send requests to the server, after doing some research into the possibility of keeping this split and support the ability of the vue client to use mTLS certificates; it inst builtin to the client currently in use (CapacitorHTTP), although there is a plugin that can add this support, it seems its not easy to add this into the app.

So the solution i am working towards is redirecting the requests into the kotlin code via the use of a custom capacitor plugin. this will allow the vue code to detect the presence of the plugin and thus the ability to reroute request via the Kotlin. for IOS this plugin wont exists and the vue will fallback to existing clients without mTLS support.

Comment and suggestion are welcome, I'm not a native app developer, so I'm bundling through this a lot with trial and error.

How have you tested this?

TBD

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/advplyr/audiobookshelf-app/pull/1692 **Author:** [@Jnewbon](https://github.com/Jnewbon) **Created:** 9/23/2025 **Status:** 🔄 Open **Base:** `master` ← **Head:** `mTLS-KotlinClientUpdate` --- ### 📝 Commits (3) - [`ebf5ad6`](https://github.com/advplyr/audiobookshelf-app/commit/ebf5ad67bc750956e6513134cd234c0beeb2dc0e) got mTLS user cert selection and persistence alongside the server connection details as a read only field - [`3ed7c52`](https://github.com/advplyr/audiobookshelf-app/commit/3ed7c52ffa510a6b889db578a5c63578e1c77240) Update API handler to seperate client builder into own class that also handles TLS config and rebuild when set - [`85157f0`](https://github.com/advplyr/audiobookshelf-app/commit/85157f06e0d2f97c74ecd57b8ac8ebac649effd9) Updated the HttpClient with a builder and added a download client with JIT instantiation ### 📊 Changes **12 files changed** (+338 additions, -47 deletions) <details> <summary>View changed files</summary> 📝 `android/app/src/main/java/com/audiobookshelf/app/MainActivity.kt` (+2 -0) 📝 `android/app/src/main/java/com/audiobookshelf/app/data/DeviceClasses.kt` (+2 -1) 📝 `android/app/src/main/java/com/audiobookshelf/app/managers/InternalDownloadManager.kt` (+2 -3) ➕ `android/app/src/main/java/com/audiobookshelf/app/plugins/AbsCertificate.kt` (+32 -0) 📝 `android/app/src/main/java/com/audiobookshelf/app/plugins/AbsDatabase.kt` (+8 -2) 📝 `android/app/src/main/java/com/audiobookshelf/app/server/ApiHandler.kt` (+54 -35) ➕ `android/app/src/main/java/com/audiobookshelf/app/server/HttpClientProvider.kt` (+75 -0) ➕ `android/app/src/main/java/com/audiobookshelf/app/server/MtlsOkHttpClientFactory.kt` (+103 -0) 📝 `components/connection/ServerConnectForm.vue` (+37 -4) ➕ `plugins/capacitor/AbsCertificate.js` (+14 -0) 📝 `plugins/capacitor/AbsDatabase.js` (+7 -1) 📝 `plugins/capacitor/index.js` (+2 -1) </details> ### 📄 Description ## Brief summary Implementation of Mutual TLS support on the Android platform ## Which issue is fixed? Resolves #1419 Resolves #353 ## Pull Request Type Affects Android, Both front and back end ## In-depth Description My plans as it stands is, - Build UI Client cert selector for each server - [x] Select a cert per server - [ ] Edit a cert for existing servers - Update Kotlin API to make use of the selected cert - [x] Separate the client builder and encapsulate mTLS usage - [x] Redirect API calls into this new builder - [ ] Add plugin to accept request form frontend and route them through the new builder - [ ] Tested that this actually works - Update the VUE components to make use of the cert - [ ] Isolate all http calls into a central class - [ ] Add logic to detect if call can be redirected into the backend - [ ] Add ability to execute calls should backend not exist ### 1. UI Selection That was a bit of a failed investigation, the SSL handshake in mTLS pipeline should allow for the server contacted to request the client (App) to send its user cert prompting the app to pop up a dialog listing installed certificate to choose from during the connection process. This would be an ideal situation as no extra UI would be needed, if the server needs a cert the user is prompted for on automatically Sadly documentation for mTLS heavily favours hard-coded cert and keys where the app developer provide their own server and only want verified apps to be able to communicate with their server. i have been unable to find a way of getting the process to be automated thus have fallen to the backup of getting the user to manually select a cert when setting up the server connection. <details> <summary>ScreenShot</summary> <img width="370" height="357" alt="Image" src="https://github.com/user-attachments/assets/f185434d-3e3e-4604-b272-407c04018d3e" /> <img width="370" height="357" alt="Image" src="https://github.com/user-attachments/assets/207d49aa-3167-40bc-918b-a04cd4c06bda" /> <img width="370" height="357" alt="Image" src="https://github.com/user-attachments/assets/b347dad2-8181-4926-9686-c9b5a878a4e4" /> </details> ### 2. Kotlin API Updating the Kotlin code to use mTLS based on a pre-selected certificate is well documented, so implementing this wasn't overly difficult, the main issue is ensuring that all calls in the Kotlin code based is routed via a client that has the mTLS certificate set. While this code is mostly done i haven't been able to test it properly due to the next section. ### 3. VUE API The app is split in two, Kotlin and vue, both have their own client that independently send requests to the server, after doing some research into the possibility of keeping this split and support the ability of the vue client to use mTLS certificates; it inst builtin to the client currently in use (CapacitorHTTP), although there is a plugin that can add this support, it seems its not easy to add this into the app. So the solution i am working towards is redirecting the requests into the kotlin code via the use of a custom capacitor plugin. this will allow the vue code to detect the presence of the plugin and thus the ability to reroute request via the Kotlin. for IOS this plugin wont exists and the vue will fallback to existing clients without mTLS support. Comment and suggestion are welcome, I'm not a native app developer, so I'm bundling through this a lot with trial and error. ## How have you tested this? TBD --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

adam added the pull-request label 2026-04-25 00:00:28 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/audiobookshelf-app#1664