Feature request: Option not to trust system CAs (certificate pinning)

[feisar]

Hi,

First of all thanks for the great app, ownCloud with DAVdroid is great!

I have noticed that app developers are starting to add a user option into their apps which gives the option not to trust any of the pre-installed, system-wide certificate authorities - Instead the app will only trust a specific, accepted certificate.

This functionality is relevant to DAVdroid because ownCloud it is meant to be a private, personal cloud solution so there is a very good argument for clients only trusting a personal, private certificate.

The Conversations app is an example of where this has been implemented:
https://play.google.com/store/apps/details?id=eu.siacs.conversations&hl=en

Here is an Android library project which may be useful:
https://github.com/moxie0/AndroidPinning

And here’s an explanation (provided by the developer of the above library) as to why it’s really quite an important feature:
http://www.thoughtcrime.org/blog/authenticity-is-broken-in-ssl-but-your-app-ha/

Hope this feature can be added to (the otherwise fantastic) DAVdroid!

(I think it may also help to get around the many certificate problems people seem to have with DAVdroid)

[rfc2822]

Hello,

Thanks for your suggestion. While I don’t think it makes sense to not trust system-wide CAs on app level (if you distrust those CAs, wouldn’t they have to be removed/disabled in the system so that they can’t do any harm in other apps, too?), I certainly support that certificate pinning would be a good thing.