{"id":918,"date":"2014-07-21T23:17:29","date_gmt":"2014-07-22T04:17:29","guid":{"rendered":"http:\/\/littlesvr.ca\/grumble\/?p=918"},"modified":"2019-09-20T13:36:16","modified_gmt":"2019-09-20T18:36:16","slug":"android-programming-connect-to-an-https-server-with-self-signed-certificate","status":"publish","type":"post","link":"http:\/\/littlesvr.ca\/grumble\/2014\/07\/21\/android-programming-connect-to-an-https-server-with-self-signed-certificate\/","title":{"rendered":"Android programming: connect to an HTTPS server with self-signed certificate"},"content":{"rendered":"

In a previous post<\/a> I described my frustration with the fact that it’s so difficult to find documentation about how to connect to a server using HTTPS if the certificate for that server is self-signed (not from a paid-for certificate authority).<\/p>\n

After a while I found that someone at Google noticed that because of their lack of documentation the common solution is to disable certificate checking altogether, which of course nullifies any possible advantage of using HTTPS. So they posted some documentation, and after struggling with it for a while I finally got it to work.<\/p>\n

You don’t need to use BouncyCastle<\/span>, just the stock Android APIs, you should be able to easily customise this code for your own uses:<\/p>\n

    \/**\n     * Set up a connection to littlesvr.ca using HTTPS. An entire function\n     * is needed to do this because littlesvr.ca has a self-signed certificate.\n     * \n     * The caller of the function would do something like:\n     * HttpsURLConnection<\/span> urlConnection<\/span> = setUpHttpsConnection<\/span>(\"https:\/\/littlesvr.ca\");\n     * InputStream<\/span> in = urlConnection<\/span>.getInputStream();\n     * And read from that \"in\" as usual in Java\n     * \n     * Based on code from:\n     * https:\/\/developer.android.com\/training\/articles\/security-ssl.html#SelfSigned<\/span>\n     *\/\n    @SuppressLint<\/span>(\"SdCardPath<\/span>\")\n    public static HttpsURLConnection<\/span> setUpHttpsConnection<\/span>(String urlString<\/span>)\n    {\n        try\n        {\n            \/\/ Load CAs<\/span> from an InputStream<\/span>\n            \/\/ (could be from a resource or<\/span> ByteArrayInputStream<\/span> or ...)\n            CertificateFactory<\/span> cf = CertificateFactory.getInstance(\"X.509\");\n            \n            \/\/ My CRT file that I put in the assets folder\n            \/\/ I got this file by following these steps:\n            \/\/ * Go to https:\/\/littlesvr.ca using Firefox\n            \/\/ * Click the padlock\/More\/Security\/View Certificate\/Details\/Export\n            \/\/ * Saved the file as littlesvr.crt (type X.509 Certificate (PEM))\n            \/\/ The MainActivity.context is declared as:\n            \/\/ public static Context context;\n            \/\/ And initialized in MainActivity.onCreate() as:\n            \/\/ MainActivity.context = getApplicationContext();\n            InputStream<\/span> caInput<\/span> = new BufferedInputStream<\/span>(MainActivity.context.getAssets().open(\"littlesvr.crt\"));\n            Certificate ca = cf.generateCertificate(caInput<\/span>);\n            System.out.println(\"ca=\" + ((X509Certificate<\/span>) ca).getSubjectDN<\/span>());\n            \n            \/\/ Create a KeyStore<\/span> containing our trusted CAs<\/span>\n            String keyStoreType<\/span> = KeyStore<\/span>.getDefaultType();\n            KeyStore<\/span> keyStore<\/span> = KeyStore.getInstance(keyStoreType<\/span>);\n            keyStore<\/span>.load(null, null);\n            keyStore.setCertificateEntry(\"ca\", ca);\n            \n            \/\/ Create a TrustManager<\/span> that trusts the CAs<\/span> in our KeyStore\n            String tmfAlgorithm<\/span> = TrustManagerFactory<\/span>.getDefaultAlgorithm();\n            TrustManagerFactory tmf<\/span> = TrustManagerFactory.getInstance(tmfAlgorithm<\/span>);\n            tmf.init(keyStore);\n            \n            \/\/ Create an SSLContext<\/span> that uses our TrustManager<\/span>\n            SSLContext<\/span> context = SSLContext<\/span>.getInstance(\"TLS\");\n            context.init(null, tmf.getTrustManagers(), null);\n            \n            \/\/ Tell the URLConnection<\/span> to use a SocketFactory<\/span> from our SSLContext\n            URL url<\/span> = new URL(urlString<\/span>);\n            HttpsURLConnection<\/span> urlConnection<\/span> = (HttpsURLConnection<\/span>)url.openConnection();\n            urlConnection.setSSLSocketFactory(context.getSocketFactory());\n            \n            return urlConnection;\n        }\n        catch (Exception ex)\n        {\n            Log.e(TAG, \"Failed to establish SSL connection to server: \" + ex.toString());\n            return null;\n        }\n    }\n<\/pre>\n
Good luck! And you’re welcome.<\/p>\n
P.S. 20 september 2019: For some reason the solution above is insufficient on Android 28 and 29 (Pie and Q). On the emulators I tried it required an extra bit of code just before the return urlConnection<\/code>:<\/p>\n
            \/\/ 20 september 2019:\n            \/\/ For some reason this call to setHostnameVerifier() has become necessary in\n            \/\/ Android 28 (also doesn't work in 29).\n            \/\/ In older Androids everything works fine without this.\n            urlConnection.setHostnameVerifier(new HostnameVerifier() {\n                @Override\n                public boolean verify(String hostname, SSLSession session) {\n                    if (hostname.equalsIgnoreCase(\"littlesvr.ca\")) {\n                        return true;\n                    } else {\n                        return false;\n                    }\n                }\n            });<\/pre>\n
I don’t know why that extra requirement. My certificate is for only one host, and it’s the host I’m connecting to. It even has reverse DNS set up.<\/p>\n","protected":false},"excerpt":{"rendered":"
In a previous post I described my frustration with the fact that it’s so difficult to find documentation about how to connect to a server using HTTPS if the certificate for that server is self-signed (not from a paid-for certificate authority). After a while I found that someone at Google noticed that because of their … <\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,4],"tags":[],"class_list":{"0":"entry","1":"post","2":"publish","3":"author-andrew","4":"post-918","6":"format-standard","7":"category-opensource","8":"category-safeforseneca"},"_links":{"self":[{"href":"http:\/\/littlesvr.ca\/grumble\/wp-json\/wp\/v2\/posts\/918","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/littlesvr.ca\/grumble\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/littlesvr.ca\/grumble\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/littlesvr.ca\/grumble\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"http:\/\/littlesvr.ca\/grumble\/wp-json\/wp\/v2\/comments?post=918"}],"version-history":[{"count":5,"href":"http:\/\/littlesvr.ca\/grumble\/wp-json\/wp\/v2\/posts\/918\/revisions"}],"predecessor-version":[{"id":1300,"href":"http:\/\/littlesvr.ca\/grumble\/wp-json\/wp\/v2\/posts\/918\/revisions\/1300"}],"wp:attachment":[{"href":"http:\/\/littlesvr.ca\/grumble\/wp-json\/wp\/v2\/media?parent=918"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/littlesvr.ca\/grumble\/wp-json\/wp\/v2\/categories?post=918"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/littlesvr.ca\/grumble\/wp-json\/wp\/v2\/tags?post=918"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}