Late warning when "distrust system certificates" checked

[ploink]

The letsencrypt certificate on my server was renewed using automated script, server restarted. Two days and a few hours later I got the security popup from davx5 "Please review the certificate".
Using Davx5 4.4.0.1-ose

I verified from the logs that the server (apache used as proxy to provide ssl for local radicale dav server) restarted after renewal and has not restarted or reloaded since. The old certificate was deleted after successful renewal but I checked my backup and it is still valid for 3 more days.
I remember same issue has happened after previous renewal.
Could this be a security bug?

[sunkup]

Sorry, I don't understand. What do you think should be a bug?

Please have a look here as well:
https://www.davx5.com/faq/synchronization/why-is-my-tls-certificate-not-accepted

[ploink]

The bug is: Why does davx5 generate a warning more than two days after the event? It should warn IMMEDIATELY.

If I remember correctly, previous time was much longer than two days, more like a week or so.
I have checked the "distrust system certificates" option months ago, did not work when it was needed, warned two days too late. The warning came at the moment when I hit the refresh button on my TODO agenda app widget.

I mean, if there is a security event, say a burglary going on, you are not going to schedule in your agenda for next week to call the police. You call 911 immediately.

DavX5 is syncing at regular intervals so it must have encountered the new cert very shortly after renewal yet remained silent.
I am just guessing here, but perhaps DavX5 is checking a cached certificate and not the latest version? Or perhaps it only generates the warning when you sync manually and not with scheduled syncs?

I could do some more testing if you want, forcing another cert renewal.

[sunkup]

Thank you for clarifying.

I have looked into it and for me DAVx5 complains immediately at the next connection attempt after the certificate has changed.

DavX5 is syncing at regular intervals so it must have encountered the new cert very shortly after renewal yet remained silent.

Maybe DAVx5 was unable to sync due to aggressive battery saving behaviour or missing/undetected internet connection (when using a VPN)?

I could do some more testing if you want, forcing another cert renewal.

If you can reliably reproduce the behaviour, please send us verbose logs and we can dive deeper. 👍

[ploink]

Hi @sunkup, thanks and sorry for not replying last year.

I do have some additional info:

When the security notification appears, it disappears on its own after several minutes or so. It does not appear again even when I force a manual sync, not until after a reboot or app force-stop/restart.

Likely the notification did initially appear after a certificate change but I just missed it. If it pops up at night for just a few minutes I am never gonna notice it. I think this is the core issue but I am not sure if it is my phone or DAVx5 that disappears the notification.

The "verbose logging" notification does not disappear and no notifications from other apps ever auto-disappear.
I am using crdroid (Lineage OS Android 13 based) with the app battery optimization disabled.

Any ideas?
Thanks.

[sunkup]

When the security notification appears, it disappears on its own after several minutes or so. It does not appear again even when I force a manual sync, not until after a reboot or app force-stop/restart.

That's weird. I don't think that DAVx5 is doing that. DAVx5 uses cert4android (library) to show the notification. Tapping on the notification will take you to a certificate trust decision dialog, which shows the certificate and lets you accept or reject it. As far as I can see in the code, cert4android (DAVx5) will only cancel/dismiss the notification when a user decision has been made and like I said before it works fine on my test devices.

We could start looking into your logs, but ... there has also been some unreliability in whether the trust decision dialog will be shown or not (See #1313 for details). We are rewriting that part in the upcoming versions 4.4.8 and 4.5. With #1331 DAVx5 will show the notification itself (instead of cert4android), so in case this actually is a bug in DAVx5, it might just disappear with the next few versions.

[ploink]

It does seem to be a davx5/cert4android issue.
This is how I reproduce the disappearing notification:

1. Enable "distrust system certificates" in settings.
2. Tap "Reset (un)trusted certificates"
3. Hit the refresh button in the main window.
4. The notification icon appears in the status bar and a sound is played, but nothing else shows.
5. If I do nothing, or only view the notification without making any decision it disappears in 60 seconds, reproducible.

In the source for cert4android source I found the 60 second timeout value. It looks like the message disappears after the blocking ssl connection times out.
Relevant log snippet log.txt
There seems to be an unhandled exception and perhaps that is also the reason the progress bar keeps running for much longer than 60 seconds?

Anyway, if you think the upcoming rewrite fixes the issue than I am happy to wait for it.

Thank you very much for your support!

[rfc2822]

If I do nothing, or only view the notification without making any decision it disappears in 60 seconds, reproducible.

Yes that's by intention for two reasons:

1. These notifications often occur when the device connects to a WiFi with captive portal (Login button), but the user doesn't look at the device and at some time leaves the WiFi. In this case the notification would stay forever and when the user then looks at the device, they would see a quite random notification about a problem that doesn't exist anymore.
2. The TLS connection also times out at some time. It doesn't make sense to open a TLS connection, ask the user for verification and then to continue after 10 minutes because the connection would already be timed out. (The decision would be valid for future connections of course).

There's no unhandled exception in the logs, it's just the behavior described above:

2025-03-10 20:48:35 139 [CustomCertStore] User timeout while waiting for certificate decision, rejecting
2025-03-10 20:48:35 139 [syncadapter.SyncManager] SSL handshake failed
EXCEPTION javax.net.ssl.SSLHandshakeException: Certificate chain not trusted
	at org.conscrypt.SSLUtils.toSSLHandshakeException(SSLUtils.java:14)
…

But I think that currently (haven't verified it now) when a certificate is rejected (regardless of the reason, which includes timeout), it's rejected for the lifetime of the process.

So to see the message again, you can either choose the "Reset certificates" entry in DAVx5 or force the app to be killed. Then the notification will appear one time.

[ploink]

If I do nothing, or only view the notification without making any decision it disappears in 60 seconds, reproducible.

Yes that's by intention for two reasons

1. These notifications often occur when the device connects to a WiFi with captive portal (Login button), but the user doesn't look at the device and at some time leaves the WiFi. In this case the notification would stay forever and when the user then looks at the device, they would see a quite random notification about a problem that doesn't exist anymore.
2. The TLS connection also times out at some time. It doesn't make sense to open a TLS connection, ask the user for verification and then to continue after 10 minutes because the connection would already be timed out. (The decision would be valid for future connections of course).

So to see the message again, you can either choose the "Reset certificates" entry in DAVx5 or force the app to be killed. Then the notification will appear one time.

So that exactly describes the problem then. I can understand reason number 1 but definitely not 2.

You notify the user for just 60 seconds in the middle of the night about an automated certificate renewal and then never again until reboot?

Just in case I was asleep and unaware of that notification being there between 2:02am and 2:03am, I would remain completely oblivious to the fact that DAVx5 no longer syncs. Only after a reboot for some other reason I might catch the next notification and my agenda may be a week out of date by then.

[rfc2822]

You notify the user for just 60 seconds in the middle of the night about an automated certificate renewal and then never again until reboot?

Just to understand your usecase: Why do you get a notification when the certificate is renewed? Are you using the Distrust system certs feature?