Network Connection Security Configuration

Overview

Data transmitted between apps and servers must be secure to protect data confidentiality and integrity and prevent sensitive data from being stolen or tampered with. The Transport Layer Security (TLS) protocol is recommended for security purposes.

When an app accesses a cloud server via HTTPS, if the app trusts a user-installed CA certificate, the user can use network proxy tools (such as Fiddler or Charles) to perform man-in-the-middle attacks (such as viewing, tampering with requests and responses) on HTTPS messages, which may pose security risks to the app or the cloud server. Therefore, a CA certificate should be configured for legitimacy verification for the access to a cloud server via HTTPS.

This topic describes how to configure a CA certificate for an app to prevent security risks to the app or cloud server.

Configuring the CA Certificate to Verify the Server Validity

When an app attempts to connect to a server using TLS, the server provides a certificate chain to prove its identity. The app needs to use a trusted CA certificate to verify the validity of the server's certificate chain.

The certificate chain used by a server varies, depending on the scenarios.

1. Authoritative CA certificates, such as root CA certificates from CFCA and GlobalSign, comply with industry management standards and have passed audit certification. These CA certificates are highly credible.
2. CA certificates created by enterprises are used for certificate chains of internal servers. Internal apps of enterprises trust these CA certificates.

The CA certificates in the system can be classified into the following types:

1. Prebuilt CA certificates: The system is prebuilt with industry's mainstream authoritative CA certificates.
2. App-managed CA certificates: Trusted CA certificates can be prebuilt in an app's HAP, for example, CA certificates created by an enterprise.
3. User-installed CA certificates: These certificates are private CA certificates installed on the system settings page. This type of certificate has low trustworthiness and can be exploited for man-in-the-middle attacks.

You should properly configure the trusted CA certificates based on service requirements.

• For apps oriented to Internet users, you are advised to configure only the system's prebuilt CA certificates as trusted certificates.
• For enterprise apps that access only internal servers, you are advised to configure only the application-managed CA certificates as trusted certificates.
• For apps that access both the enterprise internal server and Internet servers, you are advised to configure the system's prebuilt CA certificates and application-managed CA certificates as trusted certificates based on the domain names of the accessed servers.
• During the app development and debugging process, you need to capture network packets to locate problems and perform tests. You are advised to configure the user-installed CA certificates as trusted certificates only for the debug version.
• Apps must support access to app servers through the enterprise proxy server. The CA certificate can be manually installed by the enterprise MDM system or device administrator. However, device administrators may use proxy tools to capture app network data. It is recommended that security protection be implemented at the app layer, for example, encrypting sensitive data again or signing sensitive data.
• For security-critical apps (such as payment and banking apps), bind the public key of the server certificate using SSL pinning to further improve security after configuring the CA certificate.

Network Connection Security Configuration

Configuring the System Prebuilt CA Certificates as Trusted Certificates

If the app uses a third-party library for network connection, you need to set the system's prebuilt CA certificate path /etc/security/certificates.

Example

If the third-party library curl is used to set up HTTPS connections, set the path of trusted CA certificates as follows:

curl_easy_setopt(curl, CURLOPT_CATH, "/etc/security/certificates");

Configuring Untrusted User-Installed CA Certificates

Configure untrusted user-installed certificates in the src/main/resources/base/profile/network_config.json file. The settings take effect for Network Kit and Remote Communication Kit.

{
  "network-security-config": {
    ... ...
  },
  "trust-global-user-ca": false,  //Configure whether to trust the CA certificate manually installed by the enterprise MDM system or device administrator. The default value is true
  "trust-current-user-ca": false  // Configure whether to trust the CA certificate installed by the current user. The default value is true
}

Configuring the Application-Managed CA Certificates as Trusted Certificates

If the app server uses the CA certificates created by an enterprise, you can prebuild the CA certificates in the HAP and configure the app to trust these CA certificates.

• You can configure the Network Kit and Remote Communication Kit using the src/main/resources/base/profile/network_config.json file. For example, you can prebuild the CA certificates trusted by the app to the /data/storage/el1/bundle/entry/resources/resfile/appCaCert directory and the CA certificates trusted by the specific domain to the /data/storage/el1/bundle/entry/resources/resfile/domainCaCert directory.
  Collapse

  Word wrap

  Dark theme

  Copy code

  {
    "network-security-config": {
      "base-config": {
        "trust-anchors": [
          {
            "certificates": "/data/storage/el1/bundle/entry/resources/resfile/appCaCert"
          }
        ]
      },
      "domain-config": [
        {
          "domains": [
            {
              "include-subdomains": true,
              "name": "example.com"
            }
          ],
          "trust-anchors": [
            {
              "certificates": "/data/storage/el1/bundle/entry/resources/resfile/domainCaCert"
            }
          ]
        }
      ]
    }
  }

  Cybersecurity.md

  You can also use Network Kit to specify the path of the trusted CA certificates in the code that initiates an HTTPS request.

  Collapse

  Word wrap

  Dark theme

  Copy code

  httpRequest.request( 'EXAMPLE_URL',  {
    method: http.RequestMethod.POST,
    header: {
      'Content-Type': 'application/json'
    },
    extraData: 'data to send',
    expectDataType: http.HttpDataType.STRING,
    connectTimeout: 60000,
    caPath:'/data/storage/el1/bundle/entry/resources/resfile/domainCaCert', // Specifies the trusted CA certificate path
  }, (err: BusinessError, data: http.HttpResponse) => {
    // ...
  })

  NetworkTrust.ets

  You can also use Remote Communication Kit to specify the path of the trusted CA certificates.

  Collapse

  Word wrap

  Dark theme

  Copy code

  const caPath: rcp.CertificateAuthority = {
    folderPath: '/data/storage/el1/bundle/entry/resources/resfile/appCaCert', // Specify trusted CA certificate path
  }
  const securityConfig: rcp.SecurityConfiguration = {
    remoteValidation: caPath
  };
  // Use the security configuration in the session creation
  const sessionWithSecurityConfig = rcp.createSession({ requestConfiguration: { security: securityConfig } });

  NetworkTrust.ets

• If the app uses a third-party library for network connection, you need to set the path of the app-managed CA certificate in the code. For example, if the third-party library curl is used to set up HTTPS connections, set the path of trusted CA certificates as follows:
  Collapse

  Word wrap

  Dark theme

  Copy code

  curl_easy_setopt(curl, CURLOPT_CATH, "/data/storage/el1/bundle/entry/resources/resfile/domainCaCert");

  Cybersecurity.md

Configuring the User-Installed CA Certificates as Trusted Certificates

The CA certificates installed by users pose security risks. Avoid setting this type of certificates as trusted CA certificates except in the following scenarios:

1. You need to capture network packets to locate problems and perform tests in app development and debugging process. The user-installed CA certificates are saved in the /data/certificates/user_cacerts/{userid} directory. The value of userid starts from 100.

   NOTE: The commercially released apps should not trust the user-installed CA certificates.

2. The enterprise apps need to access to app servers through the enterprise's proxy server. The CA certificates manually installed by the MDM system or device administrator are saved in the /data/certificates/user_cacerts/0 directory.

Configuring SSL Pinning

By default, an app trusts the CA certificates prebuilt in the system. If the prebuilt CA issues an untrusted certificate, apps are exposed to attacks. For security-critical apps, such as payment and banking apps, you can use SSL pinning to trust only the public key of the specified server certificate.

SSL pinning can be configured in either of the following ways: If the server domain name is fixed, static SSL pinning is recommended. Otherwise, dynamic SSL pinning is recommended.

1. Configure static SSL pinning using the network_config.json file.
   Collapse

   Word wrap

   Dark theme

   Copy code

   {
     "network-security-config": {
       "domain-config": [
         {
           "domains": [
             {
               "include-subdomains": true,
               "name": "server.com"
             }
           ],
           "pin-set": {
             "expiration": "2024-11-08",
             "pin": [
               {
                 "digest-algorithm": "sha256",
                 "digest": "g8CsdcpyAKxmLoWFvMd2hC7ZDUy7L4E2NYOi1i8qEtE=" // Hash of the server certificate public key
               }
             ]
           }
         }
       ]
     }
   }

   Cybersecurity.md

   For details, see Certificate Pinning.

2. Set the following parameters in the code to configure dynamic SSL pinning:
   • Configure dynamic SSL pinning using Network Kit:
     Collapse

     Word wrap

     Dark theme

     Copy code

     certificatePinning: [ //Optional, supports dynamic setting of certificate lock configuration information. This property is supported since API 12
        {
          publicKeyHash: 'g8CsdcpyAKxmLoWFvMd2hC7ZDUy7L4E2NYOi1i8qEtE=', // Hash of the server certificate public key
          hashAlgorithm: 'SHA-256' 
        }, {
          publicKeyHash: 'MGFiY2UyMDk5ZjEyMzI3MWQ4MDMyY2E4ODEzMmY3EtE=', // Hash of the secondary public key of the server certificate
          hashAlgorithm: 'SHA-256' 
        }
      ]

     Cybersecurity.md

     For details, see certificatePinning.

   • Configure dynamic SSL pinning using Remote Communication Kit:
     Collapse

     Word wrap

     Dark theme

     Copy code

     const keyHash: string = 'g8CsdcpyAKxmLoWFvMd2hC7ZDUy7L4E2NYOi1i8qEtE='; // Public key of the server certificate
     const session = rcp.createSession();
     const request = new rcp.Request(HTTP_SERVER);
     const pin: rcp.CertificatePinning = {
       kind: 'public-key',
       publicKeyHash: keyHash,
       hashAlgorithm: 'SHA-256'
     };
     request.configuration = {
       security: {
         certificatePinning: pin,
       }
     };
     const resp = await session.fetch(request);

     NetworkTrust.ets

     For details, see certificatePinning.