mTLS support for iOS app when connecting to self-hosted Bitwarden environments that require client certificates.

[jalenfran]

Select Topic Area

✅ Code Contribution Proposal

Code Contribution Proposal

Feature Description

Implementation of client certificate authentication (mTLS) support for iOS app when connecting to self-hosted Bitwarden environments that require client certificates.

Related Feature Request

Implementing mTLS in the Bitwarden apps

Proposed Implementation

• Client certificate import via PKCS#12 (.p12/.pfx) files
• Password-protected certificate support with secure UI prompt
• Global certificate storage (independent of user login)
• mTLS HTTP client integration for server authentication
• Certificate management UI integrated into self-hosted server configuration

Screenshots

Technical Details

• Secure certificate storage using existing app settings infrastructure
• URLSession delegate implementation for client certificate authentication
• SwiftUI interface for certificate management
• Comprehensive error handling and user feedback

Files Modified/Added

• Core certificate models and services
• HTTP client with mTLS support
• Self-hosted configuration UI updates
• State management for certificate workflows

Testing

• Successfully tested with self-hosted environments requiring client certificates
• Password-protected certificates working correctly
• Certificate removal and management functional

Looking for feedback from the community and Bitwarden team before submitting the pull request.

[github-actions[bot]]

✨ Thank you for your code contribution proposal! While the Bitwarden team reviews your submission, we encourage you to check out our contribution guidelines.

Please ensure that your code contribution includes a detailed description of what you would like to contribute, along with any relevant screenshots and links to existing feature requests. This information helps us gather feedback from the community and Bitwarden team members before you start writing code.

To keep discussions focused, posts that do not include a proposal for a code contribution will be removed.

• 💡 For feature requests and general discussion, please visit the Bitwarden Community Forums.
• ℹ️ For questions and support, visit the Bitwarden Help Center.
• 🐛 To report a potential bug, please visit the corresponding repo. Server | Clients | iOS | Android

Thank you for contributing to Bitwarden!

[gpalsson]

still not merged? It's working great for android.

[Stingray-J]

Please merge soon! Works perfectly fine on android. I'm missing the feature on iOS.

[louwe]

Yeah, I am also waiting on this. I have been using it on my Android phone, but my family uses iOS.

[jalenfran]

The PR should be merged soon I am hoping. The last review comment I received was "Thanks @jalenfran! I need to do some additional testing next week, but this is looking to be in a good spot."

[louwe]

That sounds wonderful!

I am looking forward to try it out as soon as it is released!

[gmsiegel]

+1
I’m an iPhone user and looking forward to this. Happy to help test if needed, but it sounds like it might be good to go soon.

[jalenfran]

Hi everyone! The PR has been merged into main. The feature should be bundled in the next release.

[louwe]

Awesome, thanks!

[gmsiegel]

Is there a timeline when this release will make it to the App Store?

[louwe]

Looking at their past releases, it looks like they have a release every month, so the next one (2026.4.0) should be in a few weeks.

[Nexulo]

As usual, they don't seem interested in finally adding this long-overdue feature to the latest release.

https://github.com/bitwarden/ios/releases

[Stingray-J]

Thanks for explaining! Makes sense. So I guess in 2 weeks. :)

[Nexulo]

It would be greatly appreciated if, after two weeks, the implemented mTLS solution could finally be made available in the iOS App Store version. When can we expect this to be released @matt-livefront ?

[jalenfran]

It would be greatly appreciated if, after two weeks, the implemented mTLS solution could finally be made available in the iOS App Store version. When can we expect this to be released @matt-livefront ?

I believe they do a biweekly release schedule. If this PR passes through in the QA period he mentioned before, then I believe we might see it on Friday.

[maxkpower]

Hey all, today's release has been moved to next Thursday. From there, it goes through app store approval and will gradually roll out to everyone over approximately 7 days. We'll keep you posted!

[louwe]

Appreciate the heads-up.

[HarterHorst]

Just installed 2026.4.0 (3082) in IOS 26.4.1 and the single server approach (Server URL in Self-hosted Environment) does not work with mTLS. But what still works is a separation of the endpoints in the custom environment section.

I have the following setup running.

• Web vault server URL -> server.domain.tld with mTLS enabled
• API Server URL -> server-backend.domain.tld without mTLS but with rate limits
• Identity Server URL -> server-backend.domain.tld without mTLS but with rate limits

I had to configure two different host names with traefik because traefik does not support different TLS settings on the same hostname.

So at least the Web vault server has mTLS but the other 2 endpoints have rate limits. Not perfect but depending on security requirements and personal paranoia level this might work.

[Hangvogel]

Any progress on this? Waiting for this so badly! This is the cherrie on the pie ;-)

[Nexulo]

Unfortunately, it was mentioned here in the thread yesterday (a few posts above, as you can see here https://github.com/orgs/bitwarden/discussions/15491#discussioncomment-16770717 ) that this week’s release has been postponed to next week. No explanation, but that’s nothing new with the people in charge here.

The implementation has now been finished for almost a month, @jalenfran did an excellent and extremely fast job.

[louwe]

Looks like there was finally a release yesterday. I think this one finally has it. I have verified that it works great!
https://github.com/bitwarden/ios/releases/tag/v2026.4.1-bwpm

[thescienceguykris]

@thescienceguykris mine does that too, with the error “This is not a recognized Bitwarden server. You may need to check with your provider or update your server.” As soon as I switch back to not requiring client certs, it allows me to log in normally without an error.

Did you figure it out?

[gmsiegel]

For iOS are you using a .p12 cert, and for Android a .pfx? The type matters for each…

[thescienceguykris]

For iOS are you using a .p12 cert, and for Android a .pfx? The type matters for each…

Yeah double checked it's p12

[louwe]

It should work fine. It worked for me on iOS, Android, and Firefox and I use the same p12 for all 3 and all my other mTLS services.

If it doesn't work for you, most likely either your server isn't setup correctly or your p12 wasn't generated correctly.

[KevinFumbles]

Just fixed mine, turns out I only had the root CA cert listed in the reverse proxy instead of the whole chain with the intermediate. It had worked during testing on a browser but not the app. I assume the app was filtering for certificates signed by the trusted cert sent from the proxy.

[thescienceguykris]

Interesting. I do only have the root certificate in the reverse proxy but my client certificate has the whole chain. Mostly because I have a few different intermediate certificates depending on the context. Might just have to swallow the loss and put multiple intermediate certificates into my reverse proxy Sent from [Proton Mail](https://proton.me/mail/home) for iOS.

…

-------- Original Message --------

On Wednesday, 06/24/26 at 00:46 Kevin ***@***.***> wrote: Just fixed mine, turns out I only had the root CA cert listed in the reverse proxy instead of the whole chain with the intermediate. It had worked during testing on a browser but not the app. I assume the app was filtering for certificates signed by the trusted cert sent from the proxy. — Reply to this email directly, [view it on GitHub](#15491?email_source=notifications&email_token=AK6FYDPZ46A7CWJK3YACOI35BMJD7A5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCNZUGEZTKOJXUZZGKYLTN5XKO3LFNZ2GS33OUVSXMZLOOSWGM33PORSXEX3DNRUWG2Y#discussioncomment-17413597), or [unsubscribe](https://github.com/notifications/unsubscribe-auth/AK6FYDNJ2DZWQ6KAPGPJJ3T5BMJD7AVCNFSNUABGKJSXA33TNF2G64TZHM2TGNJTHA4DSOJ3IRUXGY3VONZWS33OHM4DKNBQGI2DJILWAI). You are receiving this because you were mentioned.Message ID: ***@***.***>

[jalenfran]

You all were right. The app was only sending the leaf cert in the handshake, not the intermediate, so a proxy that only trusts the root CA can't build the chain and bails. Browsers and Android send the whole chain from the .p12, which is why it worked everywhere but here.

@thescienceguykris you shouldn't have to swallow the loss permanently, root-only proxy + full-chain .p12 is exactly the case that was broken. I put up a fix:

• issue: [PM-39573] mTLS client certificate authentication fails when the reverse proxy trusts only the root CA ios#2832
• PR: [PM-39577] Pm 39573/mtls client certificate chain ios#2833

Now it pulls the intermediates out of the .p12 on import and sends the full chain. Backward compatible, so flat-CA setups are unaffected — once it lands just re-import your .p12.

Until then the workaround still works: drop the intermediate into your proxy's client-CA bundle (ssl_client_certificate on nginx).