mTLS / Client Certificates support

Feature Suggestions
, ,
1

Hello,

For context, in case not already aware, Mutual TLS / Client Certificate authentication is a way to only allow clients with a valid TLS certificate to access an networked resource. It’s the reverse of what’s used in HTTPS, hence the term ‘mutual.’ These certificates can also be centrally revoked when the client is compromised. Clients without a valid certificate cannot access a networked resource at all. It has been used in the enterprise for some time now. It is getting more interest from folks self-hosting services like Plex and are willing to invest the time for greater security when exposing services to the Internet, especially when access is limited to a small number of people.

Right now, it’s possible to use a reverse proxy to protect Plex remote sharing using client certificate authentication, and it works well in the browser and on operating systems that have global stores for TLS certificates. Unfortunately, on iOS and Apple TV, there is no ‘global keychain’ like there is on macOS and other operating systems. This means for apps, other than Apple apps like Safari, to access services protected by mTLS, they need to store the client certificate in their own Keychain. [3] This is an unfortunate consequence of an outdated design choice against a global keychain by Apple on iOS.

I know this is a niche request, but it would be much appreciated if importing of client certificates could be enabled on iOS, iPadOS, and tvOS apps.

Thanks for the consideration.

[1] Mutual authentication - Wikipedia
[2] https://codeburst.io/mutual-tls-authentication-mtls-de-mystified-11fa2a52e9cf
[3] Technical Q&A QA1745: Making Certificates and Keys Available To Your App

2

This is also a missing feature in the Plex Android app. While Android does have a global key store, the Plex app does not appear to have the necessary integration to allow the user to select a client certificate when accessing a remote PMS. (See the Android KeyChain documentation for the necessary APIs; it is not too hard!)

It would be great if the Plex Android app supported this method of authentication! Client certificate authentication provides an extra layer of security for users who are concerned about potential security vulnerabilities in Plex or otherwise desire a heightened security posture.

Currently, the only work-around is to access the PMS web UI via the Android browser (which of course does support client certificate authentication). While this can work, it is certainly not as nice as the native app interface!