moOde App - Add to Home screen & HTTPS

[the_bertrum]

I've just tried a vanilla fresh installation with no changes other than those available in the imager.  I added the CA:TRUE in the gen-cert.sh file and turned on HTTPS and downloaded the certificate.  I used Warpinator to get it onto my pixel 6 running Android 15.  From there I followed the "Android" section of the guide in the repo.

Happy to report it all worked nicely (sorry Kent).

Here is Chrome on my phone showing it is using the auto generated cert:
   
Here the UI in "full Chrome" all secure:
   
Here the same but installed as an App:
   

One possible reason for mine and Kent's differences, I've also go my own "local CA" root cert on the phone, pretty sure by my understanding of how authority works that this cannot be having any effect, but I suppose I could try again with it removed if anyone thinks it worth a try.
   

[TheOldPresbyope]

@the_bertrum

Hi, Robert.

I see essentially the same when I view the cert in my Chrome/Android browser and the list of trusted certs in Android itself.

Some differences between your setup and mine:

1 As you said, you have a local CA cert installed on your phone (which implies a corresponding server running on your LAN) and I don't.

2. you have (I assume) a working local DNS resolver running on your LAN and I don't. It's mDNS only for local hostname resolution on my LAN. 

It's probably easier for you test the impact of #1 by deleting your local CA cert than it is for me to stand up a local CA authority, etc.

As for #2, I mention it because Chrome/Android is throwing a DNS_PROBE_FINISHED_NXDOMAIN code when I try to access the HTTPS-enabled moOde player by its mDNS name (e.g., with a .local extension). I've tried using apps from the Google app store to monitor the network traffic but the output was too cursory to see what's going wrong (a real man would root his phone so he could use a sketchy app he found on the InterWeb™...I'm not that guy).


---

It seems I misspoke the other day about Firefox and Chrome not reaching my HTTPS-enabled moOde player (hostname moodex) via either mDNS name or IP address. Today, I'm seeing somewhat different results.

A. Chrome: using mDNS name still doesn't work (see above) but using the IP address does once I go through the steps to read the alert, accept the risk, and proceed. Once I've done that, I can close the tab and the browser and be able to open the WebUI without intervention on a fresh browser instance. 

B. Firefox: using mDNS name now seems to work, with the same proviso about clicking through to accept the risk and proceed. The WebUI appears with a slash through the lock icon on the address bar. Clicking on the lock icon gives me a popup "Connection is not secure" and clicking on that in turn gets me a curious

https:moodex.local
Connection is not secure
Verified by CN=moodex.local

Unlike with Chrome, when I close and open Firefox again, I have to go through the "access the risk" steps again.

With Firefox, using the IP address instead of the mDNS name now appears to work the same as I describe above for Chrome.

I'm trying religiously to empty caches where appropriate but can't guarantee that every test is done from a clean slate.


---

I want to make a change to the template CA in get-cert.sh to add the player's IP address and see if that has any noticeable effect, but other than that I'm out of ideas.

Well, I suppose for completeness I should set up a separate subnet with a WiFi access point on a spare Pi running DHCP and DNS services to seek what I can learn there.

Regards,
Kent

PS - I see differences in my Android screens than those described in the setup docs (yours and the https-setup.txt file in the repo). I'll post separately about that.

PPS - wouldn't it be fun if we're getting differently tweaked versions of Android and the browser apps in the UK and the US. Don''t want to be paranoid about it but ....

[the_bertrum]

I would not be at all surprised if the UK and US versions of "stock" Android are different in more ways that those quirky esoteric spellings you folks have

As to point of difference 1, yes I do have a local CA, but it isn't a "server" as such. It isn't "running" and isn't consulted in the process at all. The browser has a CA issued file that says "trust things signed with me" and moOde sends a file that is signed such that the browser sees it is trusted by the CA file. I'll remove the local CA file and try again even though if that has a difference then Authority doesn't work anything like I understand it. I'll cry if it makes a difference.

Point of difference 2, nope it's mDNS all the way for me as well. I'm using ".local" addresses throughout, although certs issued by my local CA also cover the (reserved) IPs of my players as belt and braces. If mDNS isn't reliable then getting the IP into the certificate will definitely improve things.

Finally, the "insecure" warning from Firefox is actually strictly correct when using this method. We have made our certificate of authority (I'm the authority who says who you can trust) and our certificate of identity (The authority you trust gave me this to prove I'm who I say I am) into the same certificate. The moOde player is saying to the browser "I'm moOde and you can trust I am who I say I am because I have said so". Firefox says "are you sure?", other browsers shrug and get on with it. You are encrypted, but you are not strictly secure because there's no trust.

[TheOldPresbyope]

@the_bertrum

This exercise reminds me of working jigsaw puzzles with my late wife. She'd "accidentally" hide a piece or two under her arm so she could be the one to finish the puzzle. 

Point of difference 2, nope it's mDNS all the way for me as well. I'm using ".local" addresses throughout, although certs issued by my local CA also cover the (reserved) IPs of my players as belt and braces. If mDNS isn't reliable then getting the IP into the certificate will definitely improve things.

Last night, I did as I mentioned in my last post and  reserved IP addresses for the Ethernet and WiFi interfaces on my moOde player, modified the cert to include them as subject alternative names, and redid the enable HTTPS, etc., dance. Now Firefox and Chrome on my Pixel 6a seem to be  behaving as  I expected.

Came here this morning and found out this was already baked into your setup. Hmmm.

I don't believe mDNS is unreliable on my LAN or in Android per se. Every device is working fine with it and no device will succeed in accessing local hosts without it (or IP addresses, of course). When my router receives a request to resolve a local hostname, it appends an ISP-provided multi-level domain to it and passes the FQDN to upstream ISP servers for (unsuccessful) resolution. Are you using mDNS addressing because you can or because you must?

As for Firefox pointing out the obvious, I mentioned that only for sake of completeness because that's what Joe User will face when trying this. Firefox itself is a bit circumspect about it. For example, the "Use third party CA certificates" setting in mine says "Allows the use of third party certificates from the Android CA store." [italics added] What isn't said explicitly is that others will be allowed but will be considered insecure.

Tangential TODOs for me: figure out how to do some network sniffing of the WiFi traffic from my phone to read the DNS requests. Stand up a more typical subnet with the DHCP/DNS services seen on a typical home LAN to test in.
Suggest a few editorial chances to the guide doc.

For all that, the approach set forth in the guide doc seems to be working well enough in the main.

Regards,
Kent

[the_bertrum]

Are you using mDNS addressing because you can or because you must?

Now until you asked I'd have said because I must but I just tried without the .local suffix and it worked... Hmm.

What isn't said explicitly is that others will be allowed but will be considered insecure.

Well it would (and does in full my setup) consider it secure if the CA cert is different to the Identity cert.

Anyhow, I've tried the moOde automatic setup once more but with out my local CA on the phone, and it continues to work happily, but only with the .local address, my phone won't find it without .local, by laptop it seems will...

Never could get on with jigsaws, but I'd hide pieces too I think.

[Permi]

Hi,
I have installed cert with previous steps, can I update new patch 9.2.6?

[the_bertrum]

Hi,
I have installed cert with previous steps, can I update new patch 9.2.6?

If everything is working to your satisfaction with your current certs, then just upgrade and leave everything else as it is.  It will continue to work as before. If you still have issues with your current certificates (i.e. Android not opening the "install as app" links correctly, upgrade your player, delete the old certs, generate new ones and re-install them on your devices.