Bug Report: Fails when trying to load client cert protected pages

[peternewman]

About me

This bug report is submitted on behalf of me.

Observed Behavior

I'm trying to load a couple of pages that in a traditional web browser would request a client cert, which I'd pick and then they'd load successfully. However neither works in Sofie-Chef.

One gives:

[22888:1223/170045.564:ERROR:net\cert\internal\cert_issuer_source_aia.cc:136] AiaRequest::OnFetchCompleted got error -301

The other reports:

{"message":"Window "default": Load url "https://my.example.com/\"","level":"info","localTimestamp":1766509363110}
(node:24784) electron: Failed to load URL: https://my.example.com/ with error: ERR_BAD_SSL_CLIENT_AUTH_CERT
(Use SofieChef --trace-warnings ... to show where the warning was created)
{"message":"Status for "default": error Error when loading "null": Error: ERR_BAD_SSL_CLIENT_AUTH_CERT (-117) loading 'https://my.example.com/'","level":"info","localTimestamp":1766509364080}
{"message":"ERR_BAD_SSL_CLIENT_AUTH_CERT (-117) loading 'https://my.example.com/', Error: ERR_BAD_SSL_CLIENT_AUTH_CERT (-117) loading 'https://my.example.com/'\n at rejectAndCleanup (node:electron/js2c/browser_init:2:79523)\n at WebContents.finishListener (node:electron/js2c/browser_init:2:79685)\n at WebContents.emit (node:events:518:28)","level":"error","localTimestamp":1766509364082}

Expected Behavior

Sofie Chef successfully loads the URL I requested.

Version

0.4.3 and 0.3.4 of SofieChef

Severity / Impact

Can't display/switch between the pages I'd like to.

[coderabbitai]

📝 CodeRabbit Plan Mode

Generate an implementation plan and prompts that you can use with your favorite coding agent.

• Create Plan

Examples

• Example 1
• Example 2

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord or schedule a call!

[peternewman]

This is the closest I could see in terms of a quick Google for how to solve it from the Electron end:
https://www.electronjs.org/docs/latest/api/app/#event-select-client-certificate

But I'm unclear whether it would have access to the certs already on my machine (like Edge/Chrome do) or if I'd also need to separately load the cert into Electron.

[peternewman]

Actually on a bit more reading/testing it may be selecting a certificate, but not the right one (the first, where I need the second).

[nytamin]

(disclaimer: I haven't tested any of this)

Thanks for the bug report (and research into a possible solution) @peternewman!

Perhaps we can add some property to the config json, that lists preferred certificates on a per-host basis?
Something like this perhaps?

{
preferredClientCertificates: {
   [host: string]: SomeCertificateSelector
 } 
}

That way, Chef can pick the preferred client certificate in the 'select-client-certificate' event:

// pseudo code:

app.on('select-client-certificate', (event, webContents, url, list, callback) => {
  event.preventDefault()
  const certSelector = Object.entries(config.preferredClientCertificates).find(c => url.includes(c[0]))[1]
  callback(list.find(matchTheCert(certSelector))) 
})

If this makes sense to you, please submit a PR with a fix and I'll see to get it merged.

[peternewman]

Perhaps we can add some property to the config json, that lists preferred certificates on a per-host basis? Something like this perhaps?

{
preferredClientCertificates: {
[host: string]: SomeCertificateSelector
}
}
That way, Chef can pick the preferred client certificate in the 'select-client-certificate' event:

That seems plausible, from a quick hack of Sofie-chef to add some debugging and pick the last, rather than first cert in the list. Firstly it works/resolves my problem, so should do in the longer term once implemented properly.

Secondly, from the docs at https://www.electronjs.org/docs/latest/api/app/#event-select-client-certificate and from logging what's offered, the URL it matches against is the domain:port (in my example my.example.com:443) and then on the cert side, the issuerName and subjectName are both string options (I guess the traditional Windows dialogue is also displaying serialNumber and validExpiry, but I'm personally keen to avoid having to go anywhere near dates if possible and I'd assume the serial isn't of interest to most people).

So I assume if the selector allows you to specify hopefully one or more of those fields and they can all be optional, and then as you proposed it returns the first match. If we need to add serial/expiry they can be done in future.

If this makes sense to you, please submit a PR with a fix and I'll see to get it merged.

If my slightly more detailed proposal of some of the specifics sounds reasonable I'll try and get it implemented as a PR at some point soon.

[nytamin]

Sounds good! Looking forward to the PR!
If possible, please add examples of the issuerName and subjectName as comments in the code, that'll help with maintainability.