27 Dec 2013 · 1 min read

Trusting a Self-signed SSL Certificate

When connecting to a server which has setup their SSL encryption with a self-signed certificate through a Java or an android app, you’ll get an SSLException since their certificate isn’t signed by a Certificate Authorities (CA) which is a 3rd party who is trusted by everyone. <pre class="giallo" style="color: #657B83; background-color: #FDF6E3;" ><code data-lang="plain">javax.net.ssl.SSLException: Not trusted server certificate exception</code></pre> If you have access to the server or know the site admin, get them to buy a CA signed SSL certificate. But in case that is not possible or feasible we can one thing we can do is configure our HTTP client library to just not verify the site hostname with the certificate. But then again that is not a good solution and defeats the whole purpose of encryption. A more elegant solution is to tell the client library to explicitly trust a certificate. We’ll have to manually get a copy of the site’s self-signed certificate that we can use to tell our client to trust. Java has a couple of HTTP clients, mainly: <ul> <li>Apache HTTP client</li> <li>HttpUrlConnection</li> </ul> You’ll find that when using Apache Http client we’ll have to create a custom SSLSocketFactory to implement the above functionality. And for HttpUrlConnection set a custom SSLSocket to the connection as described at <a rel="noopener nofollow noreferrer external" target="_blank" href="https://developer.android.com/training/articles/security-ssl.html">developer.android.com</a>. Here is a reference implementation that does just that. <div ><script src="https://gist.github.com/shalzz/8125772.js"></script></div> <h4 id="for-httpurlconnection"><a class="zola-anchor" href="#for-httpurlconnection" aria-label="Anchor link for: for-httpurlconnection">🔗</a> For HttpURLConnection</h4> <pre class="giallo" style="color: #657B83; background-color: #FDF6E3;" ><code data-lang="java">MySSLSocketFactory sslf = null; try { KeyStore ks = MySSLSocketFactory.getKeystoreOfCA(getResources().openRawResource(R.raw.myCert)); sslf = new MySSLSocketFactory(ks); } catch (Exception e) { e.printStackTrace(); } finally { sslf.fixHttpsURLConnection(); }</code></pre> Here we create a <code>Keystore</code> containing our certificate, in this case <code>myCert</code>. Which we then use to get an instance of <code>MySSLSocketFactory</code> and then call its non static <code>fixHttpsURLConnection()</code> method. This sets the SSLSocketFactory created as the default SSLSocketFactory for HttpURLConnection. <h4 id="for-apache-http-client"><a class="zola-anchor" href="#for-apache-http-client" aria-label="Anchor link for: for-apache-http-client">🔗</a> For Apache Http Client</h4> <pre class="giallo" style="color: #657B83; background-color: #FDF6E3;" ><code data-lang="java">MySSLSocketFactory sslf = null; DefaultHttpClient client = null ; try { KeyStore ks = MySSLSocketFactory.getKeystoreOfCA(this.getResources().openRawResource(R.raw.myCert)); client = MySSLSocketFactory.getNewHttpClient(ks); } catch (Exception e) { e.printStackTrace(); }</code></pre> In this case we get a <code>DefaultHttpClient</code> created with the <code>KeyStore</code> containing our Certificates. <blockquote> Originally posted at <a rel="noopener nofollow noreferrer external" target="_blank" href="https://coding-euphoria.blogspot.in/2013/12/custom-sslsocketfactory-that-trusts.html">coding-euphoria.blogspot.in</a> Edited and updated on 20/07/2017 </blockquote>