warn before certificates expire

[restena-sw]

It would be nice to warn users that they need to refresh their configs if either their client certificate or the last of all configured trust anchor CA certificates expire.

[GarethAyres]

How would we best like to achieve this?

1. We can set the app to check the certs expiry date, when its running. This means the app will only check if the user starts the app, or leaves it running. I imagine after connecting and the next reboot, the app is not started again by users unless they have problems connecting. In which case it is too late?

2. We can start the app on a reboot. There is some persistence with the app then to perform the check once a day, for example.
   Downside to this is adding a new app permission:
   https://developer.android.com/reference/android/Manifest.permission.html#RECEIVE_BOOT_COMPLETED

This will mean all current installs need to accept the new permission for the feature to work, on update.
Another downside is some users may not like the app always starting itself. But now permissions are optional, its an option they can make. We can minimise the system resources used for this by creating a service to start, and only load the app if required.

Gareth

[restena-sw]

Hi,

This will mean all current installs need to accept the new permission for the feature to work, on update. Another downside is some users may not like the app always starting itself. But now permissions are optional, its an option they can make. We can minimise the system resources used for this by creating a service to start, and only load the app if required.

Yes the separate service sounds like a least-intrusive way that deterministically works (hoping that the user starts the app himself is not deterministic).

…

-- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 2, avenue de l'Université L-4365 Esch-sur-Alzette Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66