Two weeks ago I got the task to establish TLS secured connections via certificates to a service endpoint.
I thought it’s not a big deal, because the endpoint already uses an EV certificate from a trusted CA (SwissSign) in Switzerland. Therefore I shouldn’t have to worry that the certificate would be considered as untrusted so I don’t have to import it to the trusted certs in the Java key store etc.
FAIL! I’ve got a security exception, cert is not trusted. Same problem when I visit the website with the browser. Ok, that’s bad, SwissSign is not such a big player like thawte, so, it needs some time till it will be added to the android trusted CA list. But, when I visit thawte.com, their cert is also not trusted by android. WTF?
Windows Phone and iPhone trust my SwissSign CA and don’t complain.
So, let’s ask google, stackoverflow and the blogosphere. Found a lot of solutions how to disable certificate checking entirely.
Yeah, great, this will solve my problem, my connection will be “secure” and everyone will be able to intercept my connection and inject his own certificate. But I finally found the solution with help from other sites and some testing and debugging.
The Solution
The following main steps are required to achieve a secured connection from trusted Certification Authorities.
- Grab all required certificates (root and any intermediate CA’s)
- Create a keystore with keytool and the BouncyCastle provider and import the certs
- Load the keystore in your android app and use it for the secured connections
- Don’t use the standard java.net.ssl.HttpsURLConnection for the secure connection. Use the Apache HttpClient (Version 4 atm) library, which is already built-in in android. It’s built on top of the java connection libraries and is, in my opinion, faster, better modularized and easier to understand.
Step 1: Grab the certs
You have to obtain all certificates that build a chain from the endpoint certificate the whole way up to the Root CA. This means, any (if present) Intermediate CA certs and also the Root CA cert. You don’t need to obtain the endpoint certificate.
You can obtain those certs from the chain (if provided) included in the endpoint certificate or from the official site of the issuer (in my case SwissSign).
Ensure that you save the obtained certificates in the Base64 encoded X.509 format. The content should look similar to this:
1
2
3
|
-----BEGIN CERTIFICATE-----MIIGqTC.....-----END CERTIFICATE----- |
Step 2: Create the keystore
Download the BouncyCastle Provider and store it to a known location.
Also ensure that you can invoke the keytool command (usually located under the bin folder of your JRE installation).
Now import the obtained certs (don’t import the endpoint cert) into a BouncyCastle formatted keystore.
I didn’t tested it, but I think the order of importing the certificates is important. This means, import the lowermost Intermediate CA certificate first and then all the way up to the Root CA certificate.
With the following command a new keystore (if not already present) with the password mysecret will be created and the Intermediate CA certificate will be imported. I also defined the BouncyCastle provider, where it can be found on my file system and the keystore format. Execute this command for each certificate in the chain.
1
|
keytool -importcert -v -trustcacerts -file "path_to_cert/interm_ca.cer" -alias IntermediateCA -keystore "res/raw/myKeystore.bks" -provider org.bouncycastle.jce.provider.BouncyCastleProvider -providerpath "path_to_bouncycastle/bcprov-jdk16-145.jar" -storetype BKS -storepass mysecret |
Verify if the certificates were imported correctly into the keystore:
1
|
keytool -list -keystore "res/raw/myKeystore.bks" -provider org.bouncycastle.jce.provider.BouncyCastleProvider -providerpath "path_to_bouncycastle/bcprov-jdk16-145.jar" -storetype BKS -storepass mysecret |
Should output the whole chain:
1
2
|
RootCA, 22.10.2010, trustedCertEntry, Thumbprint (MD5): 24:77:D9:A8:91:D1:3B:FA:88:2D:C2:FF:F8:CD:33:93IntermediateCA, 22.10.2010, trustedCertEntry, Thumbprint (MD5): 98:0F:C3:F8:39:F7:D8:05:07:02:0D:E3:14:5B:29:43 |
Now you can copy the keystore as a raw resource in your android app under res/raw/
Step 3: Use the keystore in your app
First of all we have to create a custom Apache HttpClient that uses our keystore for HTTPS connections:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
|
public class MyHttpClient extends DefaultHttpClient { final Context context; public MyHttpClient(Context context) { this.context = context; } @Override protected ClientConnectionManager createClientConnectionManager() { SchemeRegistry registry = new SchemeRegistry(); registry.register(new Scheme("http", PlainSocketFactory.getSocketFactory(), 80)); // Register for port 443 our SSLSocketFactory with our keystore // to the ConnectionManager registry.register(new Scheme("https", newSslSocketFactory(), 443)); return new SingleClientConnManager(getParams(), registry); } private SSLSocketFactory newSslSocketFactory() { try { // Get an instance of the Bouncy Castle KeyStore format KeyStore trusted = KeyStore.getInstance("BKS"); // Get the raw resource, which contains the keystore with // your trusted certificates (root and any intermediate certs) InputStream in = context.getResources().openRawResource(R.raw.mykeystore); try { // Initialize the keystore with the provided trusted certificates // Also provide the password of the keystore trusted.load(in, "mysecret".toCharArray()); } finally { in.close(); } // Pass the keystore to the SSLSocketFactory. The factory is responsible // for the verification of the server certificate. SSLSocketFactory sf = new SSLSocketFactory(trusted); // Hostname verification from certificate sf.setHostnameVerifier(SSLSocketFactory.STRICT_HOSTNAME_VERIFIER); return sf; } catch (Exception e) { throw new AssertionError(e); } }} |
We have created our custom HttpClient, now we can just use it for secure connections. For example when we make a GET call to a REST resource.
1
2
3
4
5
6
|
// Instantiate the custom HttpClientDefaultHttpClient client = new MyHttpClient(getApplicationContext());// Execute the GET call and obtain the responseHttpResponse getResponse = client.execute(get);HttpEntity responseEntity = getResponse.getEntity(); |
That’s it. Took me long to figure it out, hope this helps and saves you that time.
I really hope that the android platform will implement a better mechanism in future releases for defining which Certification Authorities should be trusted or not or just expand their own trusted CA list. If they don’t, I can’t believe they will get good acceptance from the business sector. Ok, you can control which certificates you want to trust in your app, but you still can’t add thawte as a trusted CA in the android keystore and your browser will always complain about an untrusted CA. The only way I know to eliminate this problem is to root your phone (very user friendly) and add your CA manually to the android keystore.
Feel free to comment.
PREV
OMG.
Why is android team doing many things so complicated?!
Still getting:
Caused by: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: IssuerName(CN=thawte Primary Root CA, OU=”(c) 2006 thawte, Inc. ? For authorized use only”, OU=Certification Services Division, O=”thawte, Inc.”, C=US) does not match SubjectName(CN=Thawte SSL CA, O=”Thawte, Inc.”, C=US) of signing certificate
Could you try importing and using certificates from this site:
https://eu.battle.net/login/en/login.xml?app=armory&locale=en_US&ref=http%3A%2F%2Feu.wowarmory.com%2Fvault%2Fcalendar-feed.xml
to see if you can get it to work?
Hi Saran
Hmm… I could reproduce your mentioned exception. Everything looks good with the certificates. I intercepted the HTTPS with Wireshark and saw something very interesting.
The certificates are sent in the following order from the battle.net server:
> *.battle.net
>> thawte Primary Root CA
>>> Thawte SSL CA (this is the intermedaite cert)
I really can’t believe that the Cert. Path validation is so bad implemented, that the order how the server sends the certificates is important.
But I’ve had a customer, whose server was sending the endpoint server certificate twice. And I got similar exceptions in android (IE, Chrome and Firefox weren’t complaining, they also didn’t show the duplicate in the chain). We removed the duplicate from the chain and everything worked fine.
It’s really possible that the Cert. Path validation really depends on the correct order, which in may opinion sucks.
I also tried in your case to import the thawte Root cert first and then the Intermediate cert into the keystore, but still got the same exception.
Maybe you can write to battle.net to change their order, or write your own CertPathValidator or just use the crappier HttpsUrlConnection from the standard java libraries. There you can turn off certificate validation off at all (but you loose a lot of security).
Hope this helps you a bit.
Greetz
Thanks for verifying, Antoine.
I tried reverse-importing the certs into the store, but even though I imported them in this order:
> *.battle.net
>> thawte Primary Root CA
>>> Thawte SSL CA (this is the intermedaite cert)
I got this list:
Keystore type: BKS
Keystore provider: BC
Your keystore contains 3 entries
thawte Primary Root CA, 26.10.2010., trustedCertEntry,
Certificate fingerprint (MD5): 8C:CA:DC:0B:22:CE:F5:BE:72:AC:41:1A:11:A8:D8:12
*.battle.net, 26.10.2010., trustedCertEntry,
Certificate fingerprint (MD5): FC:1C:1D:FE:FF:4A:AE:EA:11:4B:54:8C:2B:F0:C1:51
Thawte SSL CA, 26.10.2010., trustedCertEntry,
Certificate fingerprint (MD5): EB:A3:71:66:38:5E:3E:F4:24:64:ED:97:52:E9:9F:1B
When I used that keystore, I got a different error:
10-26 20:43:23.743: WARN/System.err(5423): javax.net.ssl.SSLException: Not trusted server certificate
10-26 20:43:23.743: WARN/System.err(5423): at org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:371)
10-26 20:43:23.753: WARN/System.err(5423): at org.apache.http.conn.ssl.AbstractVerifier.verify(AbstractVerifier.java:92)
10-26 20:43:23.753: WARN/System.err(5423): at org.apache.http.conn.ssl.SSLSocketFactory.createSocket(SSLSocketFactory.java:381)
10-26 20:43:23.753: WARN/System.err(5423): at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:164)
10-26 20:43:23.753: WARN/System.err(5423): at org.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:164)
10-26 20:43:23.753: WARN/System.err(5423): at org.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:119)
10-26 20:43:23.753: WARN/System.err(5423): at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:348)
10-26 20:43:23.753: WARN/System.err(5423): at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:555)
10-26 20:43:23.763: WARN/System.err(5423): at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:487)
10-26 20:43:23.763: WARN/System.err(5423): at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:465)
10-26 20:43:23.763: WARN/System.err(5423): at org.homedns.saran.android.wowcalendarsync.network.NetworkUtilities.authenticateWithPass(NetworkUtilities.java:344)
10-26 20:43:23.763: WARN/System.err(5423): at org.homedns.saran.android.wowcalendarsync.network.NetworkUtilities$1.run(NetworkUtilities.java:164)
10-26 20:43:23.763: WARN/System.err(5423): at org.homedns.saran.android.wowcalendarsync.network.NetworkUtilities$5.run(NetworkUtilities.java:276)
10-26 20:43:23.763: WARN/System.err(5423): Caused by: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Could not validate certificate signature.
10-26 20:43:23.763: WARN/System.err(5423): at org.apache.harmony.xnet.provider.jsse.TrustManagerImpl.checkServerTrusted(TrustManagerImpl.java:168)
10-26 20:43:23.763: WARN/System.err(5423): at org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:366)
10-26 20:43:23.773: WARN/System.err(5423): … 12 more
10-26 20:43:23.773: WARN/System.err(5423): Caused by: java.security.cert.CertPathValidatorException: Could not validate certificate signature.
10-26 20:43:23.793: WARN/System.err(5423): at org.bouncycastle.jce.provider.PKIXCertPathValidatorSpi.engineValidate(PKIXCertPathValidatorSpi.java:342)
10-26 20:43:23.793: WARN/System.err(5423): at java.security.cert.CertPathValidator.validate(CertPathValidator.java:202)
10-26 20:43:23.793: WARN/System.err(5423): at org.apache.harmony.xnet.provider.jsse.TrustManagerImpl.checkServerTrusted(TrustManagerImpl.java:164)
10-26 20:43:23.793: WARN/System.err(5423): … 13 more
10-26 20:43:23.793: WARN/System.err(5423): Caused by: java.security.SignatureException: Signature was not verified.
10-26 20:43:23.803: WARN/System.err(5423): at org.apache.harmony.security.provider.cert.X509CertImpl.fastVerify(X509CertImpl.java:601)
10-26 20:43:23.803: WARN/System.err(5423): at org.apache.harmony.security.provider.cert.X509CertImpl.verify(X509CertImpl.java:544)
10-26 20:43:23.803: WARN/System.err(5423): at org.bouncycastle.jce.provider.PKIXCertPathValidatorSpi.engineValidate(PKIXCertPathValidatorSpi.java:337)
10-26 20:43:23.803: WARN/System.err(5423): … 15 more
Using BC version you suggested and used keytool from these Java plugins (on Win7 64bit):
jdk1.6.0_20 64bit
jdk1.6.0_22 64bit
jdk1.6.0_20 32bit
I used this to retrieve certs:
openssl s_client -connect eu.battle.net:443 -showcerts
Hi Saran
You should NOT place the *.battle.net certificate in your keystore. Your keystore should only contain the trusted issuers (the Root CA and any intermediate CA’s) and not the endpoint certificate itself.
The check if your endpoint certificate is valid is done with several other criterias, like the hostname verification (does the cert correspond to the presented site).
Please let me know if this is working.
Yes, I tried it also with only Intermediate and Root (with having tried each of them imported as 1st at one time). Same result
I’ve asked a question on StackOverflow:
http://stackoverflow.com/questions/4115101/apache-httpclient-on-android-producing-certpathvalidatorexception-issuername
Hopefully, someone will think of a solution…
Hi Seran
I tried to answer your question on stackoverflow. Hope it helps
Thanks so much for this most useful info!
Hi Antoine,
Your blog aims to tackle the exact problem I’m faced with, however I cannot get your solution to work.
I keep getting the following in LogCat:
11-19 15:12:34.777: ERROR/OpenSSLSocketImpl(520): Unknown error 5 during connect
11-19 15:12:34.777: WARN/System.err(520): java.io.IOException: SSL handshake failure: I/O error during system call, Unknown error: 0
11-19 15:12:34.786: WARN/System.err(520): at org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.nativeconnect(Native Method)
11-19 15:12:34.786: WARN/System.err(520): at org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:305)
11-19 15:12:34.786: WARN/System.err(520): at org.apache.http.conn.ssl.AbstractVerifier.verify(AbstractVerifier.java:92)
11-19 15:12:34.786: WARN/System.err(520): at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:321)
11-19 15:12:34.795: WARN/System.err(520): at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:129)
11-19 15:12:34.795: WARN/System.err(520): at org.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:164)
11-19 15:12:34.795: WARN/System.err(520): at org.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:119)
11-19 15:12:34.795: WARN/System.err(520): at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:348)
11-19 15:12:34.795: WARN/System.err(520): at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:555)
11-19 15:12:34.795: WARN/System.err(520): at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:487)
11-19 15:12:34.795: WARN/System.err(520): at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:465)
11-19 15:12:34.795: WARN/System.err(520): at me.test.TempActivity.onCreate(TempActivity.java:30)
11-19 15:12:34.805: WARN/System.err(520): at android.app.Instrumentation.callActivityOnCreate(Instrumentation.java:1047)
11-19 15:12:34.805: WARN/System.err(520): at android.app.ActivityThread.performLaunchActivity(ActivityThread.java:2459)
11-19 15:12:34.814: WARN/System.err(520): at android.app.ActivityThread.handleLaunchActivity(ActivityThread.java:2512)
11-19 15:12:34.814: WARN/System.err(520): at android.app.ActivityThread.access$2200(ActivityThread.java:119)
11-19 15:12:34.814: WARN/System.err(520): at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1863)
11-19 15:12:34.814: WARN/System.err(520): at android.os.Handler.dispatchMessage(Handler.java:99)
11-19 15:12:34.814: WARN/System.err(520): at android.os.Looper.loop(Looper.java:123)
11-19 15:12:34.814: WARN/System.err(520): at android.app.ActivityThread.main(ActivityThread.java:4363)
11-19 15:12:34.814: WARN/System.err(520): at java.lang.reflect.Method.invokeNative(Native Method)
11-19 15:12:34.814: WARN/System.err(520): at java.lang.reflect.Method.invoke(Method.java:521)
11-19 15:12:34.814: WARN/System.err(520): at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:860)
11-19 15:12:34.814: WARN/System.err(520): at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:618)
11-19 15:12:34.826: WARN/System.err(520): at dalvik.system.NativeStart.main(Native Method)
Have you seen this before? Do you know what it means. Unfortunately I cannot share the certificate with you, but I can tell you that is was a p12 certificate which I exported to a X509 in windows xp.
I really need help on this issue, any guidance would be a great help.
Cheers,
Nilz.
I tried to implemented and getting error. Any ideas?
Here is my cert list
{2df05992-4d0f-48af-9d89-342c0af1d238}, Nov 19, 2010, PrivateKeyEntry,
Certificate fingerprint (MD5): 90:99:AC:3E:0A:22:7C:81:26:EC:6F:F4:04:F5:BB:A5
GeotrustCA, Nov 19, 2010, trustedCertEntry,
Certificate fingerprint (MD5): 67:CB:9D:C0:13:24:8A:82:9B:B2:17:1E:D1:1B:EC:D4
11-19 12:34:42.577: WARN/System.err(4233): java.net.SocketException: The operation timed out
11-19 12:34:42.587: WARN/System.err(4233): at org.apache.harmony.luni.platform.OSNetworkSystem.connectStreamWithTimeoutSocketImpl(Native Method)
11-19 12:34:42.587: WARN/System.err(4233): at org.apache.harmony.luni.platform.OSNetworkSystem.connect(OSNetworkSystem.java:115)
11-19 12:34:42.597: WARN/System.err(4233): at org.apache.harmony.luni.net.PlainSocketImpl.connect(PlainSocketImpl.java:244)
11-19 12:34:42.597: WARN/System.err(4233): at org.apache.harmony.luni.net.PlainSocketImpl.connect(PlainSocketImpl.java:533)
11-19 12:34:42.607: WARN/System.err(4233): at java.net.Socket.connect(Socket.java:1055)
11-19 12:34:42.607: WARN/System.err(4233): at org.apache.http.conn.scheme.PlainSocketFactory.connectSocket(PlainSocketFactory.java:119)
11-19 12:34:42.607: WARN/System.err(4233): at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:143)
11-19 12:34:42.617: WARN/System.err(4233): at org.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:164)
11-19 12:34:42.617: WARN/System.err(4233): at org.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:119)
11-19 12:34:42.617: WARN/System.err(4233): at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:348)
11-19 12:34:42.617: WARN/System.err(4233): at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:555)
11-19 12:34:42.617: WARN/System.err(4233): at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:487)
11-19 12:34:42.617: WARN/System.err(4233): at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:465)
I am very please with your tutorial; it is very thorough, but I am having flaky success.
I am trying to use it to access Google’s login url: https://www.google.com/accounts/ClientLogin.
I built everything just the way you detailed. Then the first time I ran it I got the expected response, but every time after that I got “javax.net.ssl.SSLException: Not trusted server certificate”.
I’ve managed to get the desired response about 3 times, but nothing I change seems to have an effect. I sure would appreciate your help. I don’t know why Android makes this so difficult.
Hi,
I like to know how google manage security certificate on Android. Reason i am asking is i came across a webcast by google for android and in that they mention storing certificate on Android device and using it instead of passing it everytime and accordingly this reduces data connection overhead.
I am trying to achieve something similar.. i dont want to pass and receive server/client secure certificate everytime.
My application is kind of pushengine without google PUSH API.
Awaiting your views.
Hi there
Sorry for the late response, I was away for a couple of days.
@Nilz:
Never seen this error before. Can you provide some code (of the SSL Factory)? Maybe this helps:http://stackoverflow.com/questions/2899079/custom-ssl-handling-stopped-working-on-android-2-2-froyo
@Vlad:
The error is indicating that your operation timed out. Does your app executes the request to the server? You could intercept the traffic between the emulator and server for example with Wireshark. Sometimes the reply from the server could also be helpful.
@Nick:
Thanks.
I think the Google ClientLogin uses a different approach.
http://code.google.com/apis/accounts/docs/AuthForInstalledApps.html
@swapnil:
Do you have the link or name of the mentioned webcast?
I think I didn’t understand your question. What do you mean with storing the certificate and not passing it every time? The certificates are just passed during the establishment of the secure connection. After the cert. exchange (when all certificates are considered as trusted and valid) session keys are generated to secure the actual data. The session keys are valid until the connection closes.
Found an useful link: http://tokudu.com/2010/how-to-implement-push-notifications-for-android/
Greetz
Antoine
Hi Antoine
a very nice tutorial. Thank for that.
My question is regarding client authentication. As far as i saw, the Apache HttpClient cannot handle this situation. When using only Server Auth, it works perfect , but when setting the Server to authenticate the client it fails.Do you know something about it ?
I am trying it now the “Java way” with SSL Socket , but it fails too with ” Not trusted Server certifiate
PLZ drop me an email if you have knowledge about turials or articles dealing with that problem
Thanks in advance
Gergo
Hi Antoine
i figured out the problem with the “Not Trusted server certificate”
It was the TrustManager. For some reason i do not know, The Trustmanager could not authenticate the certificate of the server. I have implemented my own.
Client authentication works now.
but if you have any idea how to do it with the Apache HttpClient, please drop me some line
Thanks
Gergo
Hi,
I found your post while looking for a solution to a similar problem. What I need is to connect to the remote server and download the cert for my app to use. Basically steps 1 and 2 but within the app itself. Any thoughts on how to do that?
Thanks
Hi,
very useful, but I’m getting stuck with a 404 reply in the response. Have you any ideas to the reason for this?
Wireshark shows a encrypted data load, length 288, which could corespond to the expected return from the Webservice
Thanks
@Gergo
Hmm… AFAIK the Apache HttpClient is not able to handle client authentication with cert.
@Lys
Didn’t look very deep into those links.
How to create your own keystore:
http://www.coderanch.com/t/133048/Security/do-programmatically-create-keystore-import
How to obtain the certificate from the site:
http://helpdesk.objects.com.au/java/how-do-i-programatically-extract-a-certificate-from-a-site-and-add-it-to-my-keystore
@Martin
Can you access your resource via browser (without 404)?
Maybe your HTTP headers are wrong and the server returns a 404 (but another error code would be much more appropriate in this case). In my opinion 288 bytes is not very much. Maybe the 404 error itself.
You can try two approaches to see what’s going on with the response:
1. If you have the private key of the webservice (I doubt that) you can encrypt the traffic with Wireshark. See http://htluo.blogspot.com/2009/01/decrypt-https-traffic-with-wireshark.html
2. This is the PITA alternative, but you DON’T need the private key from the webservice. You can download fiddler2 (www.fiddler2.com), add the proxy certificate from fiddler (or create a new one to match the hostname to your webservice) to the app keystore. Then add an argument in your Android Emulator to use the fiddler proxy to connect to the webservice. Seehttp://mrrask.wordpress.com/2009/10/01/setting-up-the-android-emulator-for-http-debugging-using-fiddler2/ Your app in the emulator will connect to fiddler and there you can see the decrypted payload.
Hi Antonie,
Firstly, thanks heaps for this post ? it’s really really helpful & well written too!
Implemented your solution and bumping into similar problem to Nick ? where the authentication is quite flaky
though i’m not authing with Google accounts…
Without changing anything, sometimes logging in will work first attempt… other times it requires several attempts to work..
Looking at my stacktrace, I would’ve thought I got the order wrong…but I double checked that and what doesn’t make sense is that it sometimes works….
javax.net.ssl.SSLException: Not trusted server certificate
at org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:371)
at org.apache.http.conn.ssl.AbstractVerifier.verify(AbstractVerifier.java:92)
at org.apache.http.conn.ssl.SSLSocketFactory.createSocket(SSLSocketFactory.java:381)
at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:164)
….etc….
Caused by: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: IssuerName(CN=thawte Primary Root CA, OU=”(c) 2006 thawte, Inc. ? For authorized use only”, OU=Certification Services Division, O=”thawte, Inc.”, C=US) does not match SubjectName(CN=Thawte SSL CA, O=”Thawte, Inc.”, C=US) of signing certificate
at org.apache.harmony.xnet.provider.jsse.TrustManagerImpl.checkServerTrusted(TrustManagerImpl.java:168)
at org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:366)
… 24 more
Caused by: java.security.cert.CertPathValidatorException: IssuerName(CN=thawte Primary Root CA, OU=”(c) 2006 thawte, Inc. ? For authorized use only”, OU=Certification Services Division, O=”thawte, Inc.”, C=US) does not match SubjectName(CN=Thawte SSL CA, O=”Thawte, Inc.”, C=US) of signing certificate
at org.bouncycastle.jce.provider.PKIXCertPathValidatorSpi.engineValidate(PKIXCertPathValidatorSpi.java:373)
at java.security.cert.CertPathValidator.validate(CertPathValidator.java:202)
at org.apache.harmony.xnet.provider.jsse.TrustManagerImpl.checkServerTrusted(TrustManagerImpl.java:164)
… 25 more
Hi again,
the Ws can be browsed both on real device/emulator and from pc without problems. Cert chain is exported from firefox (https://google.com/accounts Worked this way).
http works fine. I’ll investigate the output from wireshark
Thnx
martin
no difference between wireshark output from http and https
very strange
Hey everyone,
I think I was able to find a fix to the sporadic nature of this solution. For those who used Antoine’s solution, but get inconsistent behavior, try importing just the root cert into your keystore and not the intermediate cert. not sure if this only worked for our setup with our servers, but it worked for us. I noticed all the exceptions I got were because it was trying to compare the root cert against the intermediate. Hope that helps!
Hi,
I finally found a solution for the 404 problem.
the Webservice I’m calling is a .Net wcf service on an Intranet server, and the config of the ws was the problem.
After doing a binding modification (http://www.codemeit.com/wcf/wcf-wsdl-xsdimport-schemalocations-link-to-local-machine-name-not-domain-name-while-hosted-in-iis.html)
a super simple config file solved the problem
I tried many other config solutions, but this one worked for me. Hope this can help others
/Martin
@pyko
I think that the order of the present certificates could still be the problem, especially when you are connecting to an endpoint, which is behind a web farm. One miss configured web server could send the certificates in the wrong order, another one not.
Check with Wireshark etc. if the order is correct.
If you are not able to change the certificate order of the webserver, you could change the order programmatically.
More info about changing the order programmatically can be found on this stackoverflow topic:http://stackoverflow.com/questions/4115101/apache-httpclient-on-android-producing-certpathvalidatorexception-issuername/4199518#4199518
@allen:
AFAIK every involved certificate must be in the keystore. Never tried to remove the intermediate cert. But I could imagine, that if the order of the certificates is sent wrong from the webserver, for example the first entry is the Root CA and not the Intermediate, then the Bouncy Castle checks only against the one and only Root CA certificate in the keystore and completes the checking. But this is just an assumption. You can also look at the link that I posted to pyko.
Hi Antoine,
Very pleased with this tutorial. In my app, I am trying to send a soap request using ksoap2, which is working fine in my test environment. If I am trying to connect to a secured site, getting ‘Not trusted server certificate’. I dont want to bypass the certificate check like it was mentioned in some of the blogs. Is it possible to implement your solution with soap. Here is how I am sending the request.
HttpsTransportSE transport = new HttpsTransportSE(URL, 443, “”, 60000);
transport.call(SOAP_ACTION, envelope);
Appreciate your help.
Thanks,
Teresa
Any luck finding an answer to Teresa’s question? I’m having the same problem. I’m fairly sure the 3rd parameter is the keystore with the certificate, but i’m not sure how to find that? Can you help?
Thanks,
Matt
@allen & @Antoine
Strangely enough just importing the root CA worked! I am able to login successfully everytime now (assuming I enter the correct credentials of course)
@Martin
I’m glad that you solved the problem. Thank you for commenting the solution here.
@pyko
Thank you very much for your testing.
@Teresa & @Matt
I’m sorry. I have no idea how to solve this one. Never used ksoap2. I can’t find any useful reference for the parameters in the HttpsTransportSE constructor. Maybe this entry helps a bit:http://stackoverflow.com/questions/2248147/andoird-ksoap2-https-problem/4438993#4438993
Keep on going and please let me know if you found a solution. Thanks