Skip to content

feat: Trust user-installed CA certificates on android - #1164

Open
arminius-smh wants to merge 1 commit into
DonutWare:developfrom
arminius-smh:develop
Open

arminius-smh wants to merge 1 commit into
DonutWare:developfrom
arminius-smh:develop

Conversation

@arminius-smh

@arminius-smh arminius-smh commented Oct 6, 2026 •

Copy link
Copy Markdown

Pull Request Description

The problem is that on android, the default dart http client does not trust user-added CA's.

This PR adds Cronet (https://pub.dev/packages/http#choosing-an-implementation officially mentioned android client) as an http Client for android and uses a createHttpClient in all the http contexts I could find, as well as replacing http.get() calls with the client from createHttpClient.

It also adds a network_security_config.xml that allows the android app to trust CA's added from the user store (which is needed since android 7 for that).

After some testing on everything I can think of, it seems like everything is working on Android with my Custom CA. Of course there could still be some instances of some stuff that I've missed, but generally it seems to work.

I would think that in general, adding createHttpClient to every http context and removing static http.get calls makes sense to have it generalized in one place.

The main reasoning behind this for me, is that for selfhosted application in my homelab, at least I personally don't want to rely on any third-party providers, pay someone else for a domain etc. since I don't expose anything to the outside, I don't see any reason to involve an outsider in that process for trusted encrypted traffic between my services.

NOTE: This is the first time that I'm touching android apps and flutter in general, so I may miss some stuff. My research was mostly based on other Issue's and PR's I've found on github related to this CA issue on android that used the network_security_config.xml and talked about Cronet as an HTTP Client alternative for dart/flutter. It also already works at least on web and linux, since there the user-added certs are in the system store and trusted (and i believe on ios and windows too)

Issue Being Fixed

Resolves #1068

For example, now I can use https://jellyfin.home.arpa with my self-signed cert from my local CA in Fladder

Screenshots / Recordings

No visual changes

Tested On

  • Android
  • Android TV
  • iOS
  • Linux
  • Windows
  • macOS
  • Web

Checklist

  • If a new package was added, did you ensure it works for all supported platforms? Is the package well maintained
  • Check that any changes are related to the issue at hand.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Custom CAs fail TLS handshake ("Unable to connect to host") / Need option to trust self-signed certs

1 participant