So I finally managed https connection with self-signed certificate on Android to work. But now I have maybe even bigger problem. I have a SOAP webservice on server and only option which I found on internet for using SOAP with Android, is utilize ksoap2 library. Problem is, that for https connection I am using a Apache HttpClient (org.apache.http.client.HttpClient) with added custom trust store. Ksoap2 itself has class HttpsTransportSE, but if I use this class I got an infamous error "no peer certificate". Is there any way to, let say, extend HttpsTransportSE and add certificate for connection?
Few other things comes to my head as well:
Is there any other SOAP client which could be used on Android?
How demanding is to actually write custom SOAP client? (As far as I know, SOAP communicates with XML, so it should be much of a problem to do a custom parser...or am I missing something?)
Thanks for any comments/answers!
If it is self signed then you can just bypass the Certificate check.
Check this https://stackoverflow.com/a/3457454/893574
It worked for me.
Related
I have Android 4.1.2 device.
I'm trying to download file from HTTPS and get error about not valid certificate.
Ok, I created custom TrustManager, which skips this error.
How to specify, that DownloadManager used my HttpClient whith custom TrustManager?
Implementing a custom "Dummy-TrustManager" is a simple but dumb idea as it destroys the security of SSL/TLS.
What you need instead is to trust that specific certificate of the server, not every (self-signed) certificate in the world!
There is a complete blog topic by Nikolay Elenkov which explains everything you need, including code samples: Using a Custom Certificate Trust Store on Android
There was recently certificate change on staging servers of my app. The server passes Qualys SSL test with grade A- ("The server does not support Forward Secrecy with the reference browsers. Grade reduced to A-") so I should be able to connect via https without adding any certs to my app, keystore or whatever. Indeed, the standard Android connection method works well (http://developer.android.com/training/basics/network-ops/connecting.html).
The problem is, I am using android-async-http all over the code, which uses org.apache.http.client. And that returns javax.net.ssl.SSLPeerUnverifiedException: No peer certificate when I connect to the site!
I can't really change the connection method in current circumstances. I'd like to stay with android-async-http and connect to my site without bypassing the SSL security.
Any tips? Some additional settings to android-async-http? Or maybe altering android-async-http source code would help?
I encountered a same problem 6 months back.
I think you will be able to solve it by :
MySSLSocketFactory extends SSLSocketFactory
Then u need to use this Class where you are creating an instace of HTTPClient and pass some parameters...
I think the link below would be helpful. If it doesn't help then i can share concrete code later...
https://stackoverflow.com/a/13812958/1386533
I have two domains: foo.net and bar.com. They both have SSL certificates, and they work well in all desktop and mobile browsers. They are hosted on the same server configured with nginx.
However, when I make a request to a domain from within a native android app, it somehow gets the certificate from the wrong domain! This results in an IO Exception:
request = new HttpPost("https://foo.net/api/v1/baz");
request.setHeader("Authorization", "user:pass");
response = httpClient.execute(request);
...
javax.net.ssl.SSLException: hostname in certificate didn't match: <foo.net> != <bar.com> OR <bar.com> OR <www.bar.com>
What would cause android/java to try using the certificate from bar.com when every other measure seems to indicate that the server is correctly configured? Nothing appears in the nginx access or error log. There is no mention of bar.com anywhere in my android project.
Edit: I'm not sure why, but it appears that the server is using the certificate for bar.com for the server IP https://198.245.xx.xxx
The most likely cause for this problem is that the server uses Server Name Indication to choose which certificate to send. If the client doesn't support SNI, the server cannot choose which certificate to send during the SSL/TLS handshake (before any HTTP traffic is sent). SNI is required when you want to use multiple certificates on the same IP address and port, but not all clients support it (notoriously, IE on any version of Windows XP, and a number of mobile browsers).
You're also visibly using the Apache HTTP Client library (not HttpsURLConnection, for which there can be SNI support with some Android versions.
Support for SNI in the Apache HTTP Client library is quite recent, and certainly hasn't made it into the Android stack.
You may find the workaround described in this article useful (although it seems only to work for Android 4.2+).
Another two options would be:
to use a distinct IP address for each host (so as not to need SNI), if you're in control of server, or
to use another HTTP Client library (e.g. HttpsURLConnection).
A solution for Apache, more like a trick:
the SSL certificates are loaded based on the vhost name from /etc/apache2/sites-enabled. So, to trick that check make sure the problematic certificate is loaded first (remember that the vhosts are loaded by name).
It looks like the certificate of foo.net is misconfigured, and is using the same hostname as bar.com
Try to run an online certificate validation tool, like https://www.digicert.com/help/ on foo.net, just to be sure.
I think that you need to regenerate the certificate of foo.net with the right hostname, or reconfigure ngix to make sure that nginx serve the right certificate for the right host.
My first time posting a question here so please do not mind my mistakes here.
I'm currently making an android application fetching and sending information from a .asmx web service.
Everything goes well with the ksoap2 library and am using HttpTransportSE to call the web service. So now what I'm trying to do is to use the HttpsTransportSE to call the web service over Https. I got java.security.cert.certpathvalidatorexception trustanchor for certpath not found exception.
I have the server certificate in .pfx , .jks and .bks format.
My questions is what do i do with it to make my HttpsTransportSE call to be success?
I've read around with articles using custom SSLSocketFactory but am still not sure how to implement it in my application.
Thanks in advance for any suggestion/advices
your ksoap library is not having the class HttpsTransportSE. you can downlaod the ksoap library of latest version "ksoap2-android-assembly-2.6.5-jar-with-dependencies". It has in built HttpsTransportSE.
In android app I am developing I need to make connection to https server.
Client has provided me with 2 files mycert.pem and mykey.pem, which I think is certificate and public keystrore of server.
I need to make secure connection using HttpsURLConnection and verify host name of server to avoid man in middle attack. I have little understanding about making https connection and cryptography terms. Most of tutorial I came across uses HttpClient and they trust all host. Can someone point me in right direction how to use .pem files to make a secure https connection using HttpsURLConnection and verify hostname.
Thanks in advance.
OK done by using following
httpsConn.setHostnameVerifier(org.apache.http.conn.ssl.SSLSocketFactory.BROWSER_COMPATIBLE_HOSTNAME_VERIFIER);
I am using BROWSER_COMPATIBLE_HOSTNAME_VERIFIER, I hope it works well.