# As a user i can connect to Passbolt behind a proxy that requires a SSL client certificate when using the Android mobile client **URL:** \ **Category:** Feature requests\ **Created:** [June 9, 2023, 9:53am UTC](https://community.passbolt.com/t/as-a-user-i-can-connect-to-passbolt-behind-a-proxy-that-requires-a-ssl-client-certificate-when-using-the-android-mobile-client/7675 "2023-06-09T09:53:56Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Karpfen](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/karpfen/32/2354_2.png) [@Karpfen](https://community.passbolt.com/u/Karpfen)\ **Post date:** [June 9, 2023, 9:53am UTC](https://community.passbolt.com/t/as-a-user-i-can-connect-to-passbolt-behind-a-proxy-that-requires-a-ssl-client-certificate-when-using-the-android-mobile-client/7675/1 "2023-06-09T09:53:56Z")
**Q1. What is the problem that you are trying to solve?** Currently the Android mobile client does not support using the client certificates present in the device’s certificate store. In instances where the (proxy-)server expects a Client Certificate, but the client does not send it, the request gets rejected entirely (403). Thus any connection from such a client is impossible. I described the issue in more detail over here before: [Using Android mobile app with SSL client certificate](https://community.passbolt.com/t/using-android-mobile-app-with-ssl-client-certificate/7524) To be clear: this is **not** about using and accepting unsigned SSL certificates. This is about the ability to authenticate requests using SSL client certificates. **Q2 - Who is impacted?** Everyone that uses the mobile client **Q3 - Why is it important and/or urgent?** It allows enforcing the use of client certificates as a security practice. **Q4 - What is your proposed solution? (optional)** When the app encounters any request that requires SSL authentication, it also sends a client certificate chosen by the user. On Android this can probably be achieved by using ClientCertRequest ([ClientCertRequest  |  Android Developers](https://developer.android.com/reference/android/webkit/ClientCertRequest)) **Q5. Community support** People can vote for this idea to show traction: _Poll ([view on site](https://community.passbolt.com/t/as-a-user-i-can-connect-to-passbolt-behind-a-proxy-that-requires-a-ssl-client-certificate-when-using-the-android-mobile-client/7675/1))_ ---
**Author:** ![garrett](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/garrett/32/545_2.png) [@garrett](https://community.passbolt.com/u/garrett)\ **Post date:** [June 9, 2023, 1:14pm UTC](https://community.passbolt.com/t/as-a-user-i-can-connect-to-passbolt-behind-a-proxy-that-requires-a-ssl-client-certificate-when-using-the-android-mobile-client/7675/2 "2023-06-09T13:14:50Z")
Maybe accomplished as an NGINX config on the server side? [NGINX ssl\_client\_certificate](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_client_certificate) ---
**Author:** ![Karpfen](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/karpfen/32/2354_2.png) [@Karpfen](https://community.passbolt.com/u/Karpfen)\ **Post date:** [June 9, 2023, 1:48pm UTC](https://community.passbolt.com/t/as-a-user-i-can-connect-to-passbolt-behind-a-proxy-that-requires-a-ssl-client-certificate-when-using-the-android-mobile-client/7675/3 "2023-06-09T13:48:24Z")
The client (Android App) currently fails to provide any SSL client certificate. The server side is fully and correctly configured. ---
**Author:** ![charli56](https://avatars.discourse-cdn.com/v4/letter/c/76d3ee/32.png) [@charli56](https://community.passbolt.com/u/charli56)\ **Post date:** [May 20, 2025, 10:44am UTC](https://community.passbolt.com/t/as-a-user-i-can-connect-to-passbolt-behind-a-proxy-that-requires-a-ssl-client-certificate-when-using-the-android-mobile-client/7675/4 "2025-05-20T10:44:16Z")
Hello, we would like to use passbolt but we are not confident to let it reachable directly on the public Internet to everyone. A password manager is not something you take that risk with. In order to add a layer of security, I only know theses solutions : - IP filtering on our firewall, but mobile clients does not have fixed public IPs - VPN, but setting VPN on mobile client is heavy, sometimes disconnect, and drain battery - Filter by client certificate on nginx/apache side Have you any other ideas ? The client certificate authentication already works when using a web browser as client. But the android app is not allowing it. We already use DAVx5 and Nextcloud android apps with client certificate and its is working very well. Maybe passbolt can implement the same way as these 2 open source apps ?