Spiceworks Mobile App SSL "Proceed Anyway" not working

cb58680 · 2017-11-21T20:39:04.000Z

Hi… referencing these old topics because this still is not fixed.

https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact=8&ved=0ahUKEwjBvMjLz9DXAhWimOAKHRisCXwQFggnMAA&url=https%3A%2F%2Fcommunity.spiceworks.com%2Ftopic%2F617356-spiceworks-mobile-app-ssl-proceed-anyway-not-working&usg=AOvVaw1CM7HxhZ3JhmRSBv7zGQM0

https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwjBvMjLz9DXAhWimOAKHRisCXwQFgguMAE&url=https%3A%2F%2Fcommunity.spiceworks.com%2Ftopic%2F1095110-spiceworks-untrusted-cert&usg=AOvVaw2SMqMKnWbBI8sKEmnd-NlS

Rod-IT · 2017-11-21T20:41:13.000Z

What version of Android are you on?

Are you accessing your own system or the cloud, or even the community?

cb58680 · 2017-11-21T20:41:27.000Z

I’m using a self signed cert so I get the warning on browsers because I don’t care right now. The app should let me proceed as it says it will but nothing happens when I click on “Yes” proceed anyway.

I’m running ver 3.2.17 of the Android app.

Rod-IT · 2017-11-21T20:42:54.000Z

I was more interested in your Android version and not the app version, is your self-signed SSL SHA256?

It this public access or on your own Wi-Fi?

cb58680 · 2017-11-21T20:46:05.000Z

I’m accessing my own server. Android 7.0 and I believe I was having the same problem with 6.x.

Rod-IT · 2017-11-21T20:47:50.000Z

But are you local to your SW install or remote and using it from outside the network?

The latter is a security risk.

You also don’t give the error, only link to previous posts, if you could include your error that would be useful

cb58680 · 2017-11-21T20:48:56.000Z

I didn’t create any cert… so “self-cert” is probably not entirely correct. I just did the default installation. It’s using HTTPS with whatever the installation does.

Rod-IT · 2017-11-21T20:50:09.000Z

self-signed - while you didn’t create it, it’ll still be self signed.

I’m going to get support to join us, but can you provide the errors please

Matt S (Spiceworks)

@matts

cb58680 · 2017-11-21T20:50:44.000Z

Accessing over public.

The “risk” is that it’s not the real server and man-in-the middle attack. I’ll button it down, but I’m setting up testing and stuff.

I can’t send you an error. The app comes up with a window exactly like what was pictured in one of the other tickets. Prompting with a warning and giving you the option to proceed or not. Neither option actually proceeds.

Rod-IT · 2017-11-21T20:56:47.000Z

My guess is, it is related to the SSL being SHA1 and your phone app/browser not supporting it any longer, try accessing your site by HTTPS on a regular browser, even mobile, does it work?

cb58680 · 2017-11-21T20:59:12.000Z

The site works everywhere on every browser including on the phone. I just have to accept the warning.

I didn’t do any cert thing so it’s whatever comes with Spiceworks installation.

Rod-IT · 2017-11-21T21:05:44.000Z

I would be tempted to put a real SSL in place and re-test. No money for a test, no problem

https://community.spiceworks.com/how_to/133208-use-letsencrypt-for-a-spiceworks-install-updated-20170103

This will also work for a production system

cb58680 · 2017-11-21T21:28:08.000Z

Fine, I’ll go though that. But can we agree the app still has this bug where it’s not allowing the user to continue?

Rod-IT · 2017-11-21T21:30:01.000Z

If you want me to say it has, sure, but I have tagged support for clarification, the app should not be used with the pre-existing SSL anyway, it could be by design it doesn’t work without a valid SSL, but this is why I have tagged support.

You are also the first person in a long time to mention it, I would think if this was still an outstanding bug, others would have spoke up.

matts · 2017-11-22T17:36:41.000Z

Chris105195:

The app should let me proceed as it says it will but nothing happens when I click on “Yes” proceed anyway.

Does it actually say “Yes” as one of the options when you try to connect to your installation?

On mine, I see the following:

Android_SSL_Cert_Warning.png562×999 71.5 KB

If I click Proceed, I’m taken to my tickets for that installation, as expected. Once I’ve clicked Proceed, I don’t see the warning again, unless I uninstall the mobile app and reinstall.

The Spiceworks Desktop App install is a base installation too, no custom certs at all, just what comes out of the box during installation.

I’m not sure what could be causing the issue you’re seeing. But if it says “Yes” (as you indicated in your post), that might be part of the problem…

cb58680 · 2017-11-29T12:35:13.000Z

It does NOT look like that. It looks like what this other ticket I referenced showed: Spiceworks Mobile App SSL "Proceed Anyway" not working

cb58680 · 2017-11-29T12:37:34.000Z

The actual screen is slightly different but the wording is the same… the buttons are:

VIEW DETAILS NO YES

Just order of the buttons is different.

cb58680 · 2017-11-29T12:42:58.000Z

Why do I see 2 different Spiceworks apps in Android store? There is nothing to indicate which is which or which is correct.

I see “Helpdesk” ver 3.2.17 updated last month

and “Spiceworks” ver 2.3.12 updated this month

Is the 2nd one just for chatting on the forums or something??

cb58680 · 2017-11-29T12:53:02.000Z

OK… I have previously deleted the login inside the app, uninstalled it, and re-installed and re-created the login and would get the same error.

This time via the Android app manager I cleared all cached and storage of the app data, then uninstalled and re-installed and re-creating the login it did show the self-signed message (which I saw the very first time I installed the app too) and I hit PROCEED and it worked. This happened the very first time I installed the app.

Then I rebooted the phone to test and now it’s still working fine.

So I have no idea what this “pinning” thing is, but I had to use the App Manager to clear all that out apparently. The bug is still that “Yes” essentially means “No”.

And removing the account within the app does not truly get rid of all data for it.

I’ll let you know if this re-occurs.