strongSwan Android - Importing/Using p12 Certificate on Work Profile

[antnat96]

I am experiencing a possible issue with the strongSwan Android app where I am unable to use a p12 certificate file (with password) on the Android Work Profile only. When I install the strongSwan Android app on the personal profile and proceed through the same steps, I am able to access my imported certificate as expected. Here is what happens on the work profile:

Installing/Naming certificate

Reports that it was installed successfully

But then - tapping "Select User Certificate" does nothing

And it does not appear in the Settings -> Security and Privacy -> More Security & Privacy -> Encryption & Credentials -> User Credentials

I have placed the certificate file itself on both the personal and work profile and attempted these steps from the work profile, the result is identical.

Please let me know if this is worthy of a bug ticket.

[tobiasbrunner]

Not sure if we can do anything about that. We use the Android-provided KeyChain API to install and access the certificate/key, so if that doesn't work, it's most likely due to an Android issue. No idea if it's a bug or an intended limitation. Can you install the certificate directly in the system settings app?

[tobiasbrunner]

Could it be that certificates are only able to be installed on the personal profile and that there is no default intent handler on the work profile to list/use installed certificates?

No idea. Is that what you see? Is the list of user certificates the same in the settings app if you switch profiles? Do you see certificate installed in the personal profile also in the work profile? Also, please check the system log if you can (e.g. via adb logcat) to see if there are any errors logged when you tap the button in the strongSwan app.

[antnat96]

Is the list of user certificates the same in the settings app if you switch profiles?

There is only one settings app and it's located on the Android 14 UI in the personal profile. It only shows a single list of installed certs, not separated by profile.

Here are the logs generated when I tap "Select user certificate" (after installing a cert via the settings app then opening strongSwan in the work profile). Would have uploaded the .logcat file but github doesn't seem to like that format.

strongswan-work-profile-select-cert.log

The log entry that jumps out most to me is this, coming from KeyChain:

[tobiasbrunner]

There is only one settings app and it's located on the Android 14 UI in the personal profile. It only shows a single list of installed certs, not separated by profile.

Hm, if they designed that key store to be "personal" only, it could very well be that accessing it from the "work" profile won't work.

Here are the logs generated when I tap "Select user certificate" (after installing a cert via the settings app then opening strongSwan in the work profile).

Does that show a list of certificates? Or does no dialog show up?

The log entry that jumps out most to me is this, coming from KeyChain:

If no dialog shows up, I wonder what alias the message refers to (or maybe the KeyChainActivity does some checks when constructing the list). Either way, it's inside that Android component, so I don't think we can do much about it.

I wonder if these messages before that one are related:

com...le.android.apps.work.clouddpc  I  [PrivateKeyResolver.java:getKeyAlias:88] No private key alias match found, returning an invalid alias
com.android.keychain                 I  Alias provided by device policy client: NXVQBd747qg1qdLrsvo49A==

That sounds like the "Android Device Policy" app (clouddpc) interfering with the selection process. The documentation for choosePrivateKeyAlias actually says: "A device policy controller (as a device or profile owner) can intercept the request before the activity is shown, to pick a specific private key alias". So are there maybe options/policies that control this? Maybe a way to grant specific apps access to the KeyChain (or specific keys in there)?

[antnat96]

Does that show a list of certificates? Or does no dialog show up?

No dialog shows up.

So are there maybe options/policies that control this?

Agreed, it does seem like something at the device policy controller level might be blocking the work profile from reaching over to the personal profile to get those certs. I am specifically using Google Workspace Enterprise with an Advanced Mobile Device Management policy. I'll poke around in the Google Workspace Admin Console and see if there is a setting to allow/block transfer of information between the profiles.

[antnat96]

Yeah, there are these 2 options and I already had them enabled.

In Google's documentation they say this about the first option "Sharing to Other Profiles"

Allows users to share data and files from their work profile to the personal space on their device. This setting does not change users' ability to share content from their personal space to their work profile.

Seems to imply that they don't manage the sharing of personal info to the work profile.

Perhaps Google Workspace just doesn't expose the ability to set that particular device policy configuration. Either way, I feel like we're grasping in the dark and are getting away from strongSwan itself so if you'd like to close this discussion that's fine with me. I will open a new one if I am able to do some testing and find more info. Thanks for your help.