Repository navigation
feat: Trust user-installed CA certificates on android - #1164
Open
arminius-smh wants to merge 1 commit into
Open
arminius-smh wants to merge 1 commit into
arminius-smh wants to merge 1 commit into
Conversation
arminius-smh
force-pushed
the
develop
branch
2 times, most recently
from
October 6, 2026 20:33
3dbc407 to
f2e0907
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull Request Description
The problem is that on android, the default dart http client does not trust user-added CA's.
This PR adds Cronet (https://pub.dev/packages/http#choosing-an-implementation officially mentioned android client) as an http Client for android and uses a createHttpClient in all the http contexts I could find, as well as replacing http.get() calls with the client from createHttpClient.
It also adds a network_security_config.xml that allows the android app to trust CA's added from the user store (which is needed since android 7 for that).
After some testing on everything I can think of, it seems like everything is working on Android with my Custom CA. Of course there could still be some instances of some stuff that I've missed, but generally it seems to work.
I would think that in general, adding createHttpClient to every http context and removing static http.get calls makes sense to have it generalized in one place.
The main reasoning behind this for me, is that for selfhosted application in my homelab, at least I personally don't want to rely on any third-party providers, pay someone else for a domain etc. since I don't expose anything to the outside, I don't see any reason to involve an outsider in that process for trusted encrypted traffic between my services.
NOTE: This is the first time that I'm touching android apps and flutter in general, so I may miss some stuff. My research was mostly based on other Issue's and PR's I've found on github related to this CA issue on android that used the
network_security_config.xmland talked about Cronet as an HTTP Client alternative for dart/flutter. It also already works at least on web and linux, since there the user-added certs are in the system store and trusted (and i believe on ios and windows too)Issue Being Fixed
Resolves #1068
For example, now I can use
https://jellyfin.home.arpawith my self-signed cert from my local CA in FladderScreenshots / Recordings
No visual changes
Tested On
Checklist