Skip to main content

Https Connection Android



I am doing a https post and I'm getting an exception of ssl exception Not trusted server certificate. If i do normal http it is working perfectly fine. Do I have to accept the server certificate somehow?




Comments

  1. I'm making a guess, but if you want an actual handshake to occur, you have to let android know of your certificate. If you want to just accept no matter what, then use this pseudo-code to get what you need with the Apache HTTP Client:

    SchemeRegistry schemeRegistry = new SchemeRegistry ();

    schemeRegistry.register (new Scheme ("http",
    PlainSocketFactory.getSocketFactory (), 80));
    schemeRegistry.register (new Scheme ("https",
    new CustomSSLSocketFactory (), 443));

    ThreadSafeClientConnManager cm = new ThreadSafeClientConnManager (
    params, schemeRegistry);


    return new DefaultHttpClient (cm, params);


    CustomSSLSocketFactory:

    public class CustomSSLSocketFactory extends org.apache.http.conn.ssl.SSLSocketFactory
    {
    private SSLSocketFactory FACTORY = HttpsURLConnection.getDefaultSSLSocketFactory ();

    public CustomSSLSocketFactory ()
    {
    super(null);
    try
    {
    SSLContext context = SSLContext.getInstance ("TLS");
    TrustManager[] tm = new TrustManager[] { new FullX509TrustManager () };
    context.init (null, tm, new SecureRandom ());

    FACTORY = context.getSocketFactory ();
    }
    catch (Exception e)
    {
    e.printStackTrace();
    }
    }

    public Socket createSocket() throws IOException
    {
    return FACTORY.createSocket();
    }

    // TODO: add other methods like createSocket() and getDefaultCipherSuites().
    // Hint: they all just make a call to member FACTORY
    }


    FullX509TrustManager is a class that implements javax.net.ssl.X509TrustManager, yet none of the methods actually perform any work, get a sample here.

    Good Luck!

    ReplyDelete
  2. This is what I am doing. It simply doesn't check the certificate anymore.

    // always verify the host - dont check for certificate
    final static HostnameVerifier DO_NOT_VERIFY = new HostnameVerifier() {
    public boolean verify(String hostname, SSLSession session) {
    return true;
    }
    };

    /**
    * Trust every server - dont check for any certificate
    */
    private static void trustAllHosts() {
    // Create a trust manager that does not validate certificate chains
    TrustManager[] trustAllCerts = new TrustManager[] { new X509TrustManager() {
    public java.security.cert.X509Certificate[] getAcceptedIssuers() {
    return new java.security.cert.X509Certificate[] {};
    }

    public void checkClientTrusted(X509Certificate[] chain,
    String authType) throws CertificateException {
    }

    public void checkServerTrusted(X509Certificate[] chain,
    String authType) throws CertificateException {
    }
    } };

    // Install the all-trusting trust manager
    try {
    SSLContext sc = SSLContext.getInstance("TLS");
    sc.init(null, trustAllCerts, new java.security.SecureRandom());
    HttpsURLConnection
    .setDefaultSSLSocketFactory(sc.getSocketFactory());
    } catch (Exception e) {
    e.printStackTrace();
    }
    }


    and

    HttpURLConnection http = null;

    if (url.getProtocol().toLowerCase().equals("https")) {
    trustAllHosts();
    HttpsURLConnection https = (HttpsURLConnection) url.openConnection();
    https.setHostnameVerifier(DO_NOT_VERIFY);
    http = https;
    } else {
    http = (HttpURLConnection) url.openConnection();
    }

    ReplyDelete
  3. While trying to answer this question I found a better tutorial. With it you don't have to compromise the certificate check.

    http://blog.crazybob.org/2010/02/android-trusting-ssl-certificates.html

    *I did not write this but thanks to Bob Lee for the work

    ReplyDelete
  4. You can also look at my blog article, very similar to crazybobs.

    This solution also doesn't compromise certificate checking and explains how to add the trusted certs in your own keystore.

    http://blog.antoine.li/index.php/2010/10/android-trusting-ssl-certificates/

    ReplyDelete
  5. None of these worked for me (aggravated by the Thawte bug as well). Eventually I got it fixed with Self Signed SSL acceptance Android and Custom SSL handling stopped working on Android 2.2 FroYo

    ReplyDelete
  6. I don't know about the Android specifics for ssl certificates, but it would make sense that Android won't accept a self signed ssl certificate off the bat. I found this post from android forums which seems to be addressing the same issue:
    http://androidforums.com/android-applications/950-imap-self-signed-ssl-certificates.html

    ReplyDelete
  7. may this thread help, but i can not tell if it works will latest API :

    http://groups.google.com/group/android-developers/browse%5Fthread/thread/1ac2b851e07269ba/c7275f3b28ad8bbc?#c7275f3b28ad8bbc

    ReplyDelete

Post a Comment

Popular posts from this blog

[韓日関係] 首相含む大幅な内閣改造の可能性…早ければ来月10日ごろ=韓国

div not scrolling properly with slimScroll plugin

I am using the slimScroll plugin for jQuery by Piotr Rochala Which is a great plugin for nice scrollbars on most browsers but I am stuck because I am using it for a chat box and whenever the user appends new text to the boxit does scroll using the .scrollTop() method however the plugin's scrollbar doesnt scroll with it and when the user wants to look though the chat history it will start scrolling from near the top. I have made a quick demo of my situation http://jsfiddle.net/DY9CT/2/ Does anyone know how to solve this problem?

Why does this javascript based printing cause Safari to refresh the page?

The page I am working on has a javascript function executed to print parts of the page. For some reason, printing in Safari, causes the window to somehow update. I say somehow, because it does not really refresh as in reload the page, but rather it starts the "rendering" of the page from start, i.e. scroll to top, flash animations start from 0, and so forth. The effect is reproduced by this fiddle: http://jsfiddle.net/fYmnB/ Clicking the print button and finishing or cancelling a print in Safari causes the screen to "go white" for a sec, which in my real website manifests itself as something "like" a reload. While running print button with, let's say, Firefox, just opens and closes the print dialogue without affecting the fiddle page in any way. Is there something with my way of calling the browsers print method that causes this, or how can it be explained - and preferably, avoided? P.S.: On my real site the same occurs with Chrome. In the ex