Securing Android Apps with SSL Certificates Posted by Adel Mubarak , Monday, October 25, 2010 at 1:43 AM, in Labels: Android

Android: Trusting SSL certificates

I used a self-signed SSL certificate for the test version of my backend web service. Since my certificate isn't signed by a CA that Android trusts by default, we need to add our server's public certificate to our Android app's trusted store.These same instructions apply to trusting a custom CA, except you'd get the public certificate directly from the CA instead of from a server.

Required tools:

• OpenSSL's command line client
• Java SE 6 (for keytool)
• Bouncy Castle's provider jar

1. Grab the public certificate from the server you want to trust. Replace${MY_SERVER} with your server's address.

echo | openssl s_client -connect ${MY_SERVER}:443 2>&1 | \  sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > mycert.pem 

For example, here's the PEM-encoded public certificate from google.com:

-----BEGIN CERTIFICATE----- MIIDITCCAoqgAwIBAgIQL9+89q6RUm0PmqPfQDQ+mjANBgkqhkiG9w0BAQUFADBM MQswCQYDVQQGEwJaQTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkg THRkLjEWMBQGA1UEAxMNVGhhd3RlIFNHQyBDQTAeFw0wOTEyMTgwMDAwMDBaFw0x MTEyMTgyMzU5NTlaMGgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlh MRYwFAYDVQQHFA1Nb3VudGFpbiBWaWV3MRMwEQYDVQQKFApHb29nbGUgSW5jMRcw FQYDVQQDFA53d3cuZ29vZ2xlLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkC gYEA6PmGD5D6htffvXImttdEAoN4c9kCKO+IRTn7EOh8rqk41XXGOOsKFQebg+jN gtXj9xVoRaELGYW84u+E593y17iYwqG7tcFR39SDAqc9BkJb4SLD3muFXxzW2k6L 05vuuWciKh0R73mkszeK9P4Y/bz5RiNQl/Os/CRGK1w7t0UCAwEAAaOB5zCB5DAM BgNVHRMBAf8EAjAAMDYGA1UdHwQvMC0wK6ApoCeGJWh0dHA6Ly9jcmwudGhhd3Rl LmNvbS9UaGF3dGVTR0NDQS5jcmwwKAYDVR0lBCEwHwYIKwYBBQUHAwEGCCsGAQUF BwMCBglghkgBhvhCBAEwcgYIKwYBBQUHAQEEZjBkMCIGCCsGAQUFBzABhhZodHRw Oi8vb2NzcC50aGF3dGUuY29tMD4GCCsGAQUFBzAChjJodHRwOi8vd3d3LnRoYXd0 ZS5jb20vcmVwb3NpdG9yeS9UaGF3dGVfU0dDX0NBLmNydDANBgkqhkiG9w0BAQUF AAOBgQCfQ89bxFApsb/isJr/aiEdLRLDLE5a+RLizrmCUi3nHX4adpaQedEkUjh5 u2ONgJd8IyAPkU0Wueru9G2Jysa9zCRo1kNbzipYvzwY4OA8Ys+WAi0oR1A04Se6 z5nRUP8pJcA2NhUzUnC+MY+f6H/nEQyNv4SgQhqAibAxWEEHXw== -----END CERTIFICATE----- 

2. Android has built-in support for the Bouncy Castle keystore format (BKS). Put Bouncy Castle's jar in your classpath, and create a keystore containing only your trusted key.

export CLASSPATH=bcprov-jdk16-145.jar CERTSTORE=res/raw/mystore.bks if [ -a $CERTSTORE ]; then     rm $CERTSTORE || exit 1 fi keytool \       -import \       -v \       -trustcacerts \       -alias 0 \       -file <(openssl x509 -in mycert.pem) \       -keystore $CERTSTORE \       -storetype BKS \       -provider org.bouncycastle.jce.provider.BouncyCastleProvider \       -providerpath /usr/share/java/bcprov.jar \       -storepass ez24get 

3. Create a custom Apache HttpClient that uses your custom store for HTTPS connections.

import android.content.Context; import org.apache.http.conn.ClientConnectionManager; import org.apache.http.conn.scheme.PlainSocketFactory; import org.apache.http.conn.scheme.Scheme; import org.apache.http.conn.scheme.SchemeRegistry; import org.apache.http.conn.ssl.SSLSocketFactory; import org.apache.http.impl.client.DefaultHttpClient; import org.apache.http.impl.conn.SingleClientConnManager;  import java.io.InputStream; import java.security.KeyStore;  public class MyHttpClient extends DefaultHttpClient {    final Context context;    public MyHttpClient(Context context) {     this.context = context;   }    @Override protected ClientConnectionManager createClientConnectionManager() {     SchemeRegistry registry = new SchemeRegistry();     registry.register(         new Scheme("http", PlainSocketFactory.getSocketFactory(), 80));     registry.register(new Scheme("https", newSslSocketFactory(), 443));     return new SingleClientConnManager(getParams(), registry);   }    private SSLSocketFactory newSslSocketFactory() {     try {       KeyStore trusted = KeyStore.getInstance("BKS");       InputStream in = context.getResources().openRawResource(R.raw.mystore);       try {         trusted.load(in, "ez24get".toCharArray());       } finally {         in.close();       }       return new SSLSocketFactory(trusted);     } catch (Exception e) {       throw new AssertionError(e);     }   } }