mTLS iOS Nextcloud app problems

📱 Desktop & mobile clients 🍏 iOS
, ,
1

Hello !

I’ve been using Nextcloud for a long time, but yesterday I enabled mTLS on the reverse proxy which is working, but I’m having issues after adding the certificate to the iOS app.

I have a rule that allow my local IP to bypass the mtls (this is working also).

I have configured Nextcloud with mutual TLS (mTLS) client certificate authentication via Apache, using a .p12 client certificate and a properly trusted CA on both macOS and iOS. Everything works correctly in Safari (macOS, windows and iOS), and Nextcloud Talk and Deck also function as expected based BUT NOT NEXTCLOUD APP.

The issue only affects the Nextcloud iOS app. During login, the app prompts for a client certificate, which is correctly installed on the iPhone and the password is accepted, but the app gets stuck in an infinite loop repeatedly asking to select the certificate without completing authentication. After temporarily disabling mTLS to allow initial login and then re-enabling it, Talk and Deck continue to work, but the main Nextcloud app remains stuck in the certificate selection loop.

I have tried to uninstall cert / nextcloud, did some reboot, nothing work.

I also disable mtls so I can login back, it worked bu now the app dont even work whith my bypass rule IP (but still working on NC talk / Deck apps)…

Thanks for your help !

iOs : 26.5

Nextcloud : 32.0.11

2

Hi all,

I can confirm the same issue on iOS 26.5 together with Nextcloud 35. I’ve successfully connect on my Android and desktop clients. Therefor I believe this is a specific issue with how the iOS app connects to mTLS secured endpoints and/or persists the passphrase.

Reverse proxy: Caddy

iOS: 26.5

Nextcloud: 35.0.1

Here is a code analysis of the iOS app as to why this might be happening (AI generated please take it with a grain of salt - just trying to help):

Code Review of the observed behavior chain

  • Server issues NSURLAuthenticationMethodClientCertificate challenge.
  • If NCNetworking.shared.p12Data is nil, didAskForClientCertificate() + cancelAuthenticationChallenge are invoked → “no client certificate found” alert → .p12 picker.
  • Picker sets p12Data/p12Password then calls login(), which opens a new handshake.
  • The new handshake’s client-cert challenge can find p12Data nil again (e.g. after onIncorrectPassword() cleared it, or because the credential is persistence: .none and not cached for the new connection) → picker reopens → repeat.

Thanks