Ogre's Lab

14 Responses to “Using Android Volley With Self-Signed SSL Certificate”

1. Peter Hilbring Says:
   May 29th, 2013 at 02:01:46

   Do you have any example about using client ssl authentification with volley?

2. Ogi Bankov / Огнян Банков Says:
   May 29th, 2013 at 02:24:35

   I am afraid that I don't but it should not be hard to do it:
   There is a description how to do it in principle http://developer.android.com/reference/javax/net/ssl/HttpsURLConnection.html (Providing an application specific X509KeyManager)

   Basically all you have to do is to load your client certificate into KeyManager and then pass that manager to the sslcontext.init( as first parameter (SslSocketFactory, line 39)

   Please note that self-signed certificate will not work as client certificate if server is not configured to accept it (which is the default).

3. Peter Hilbring Says:
   May 30th, 2013 at 03:59:50

   Thanks for your response. I'll try that in the next days.

4. Michael Says:
   February 5th, 2014 at 05:57:16

   Thanks Ognyan.

   I'm somehow stuck with a

   javax.net.SSLPeerUnverifiedExeption: No peer certificate.

   Any idea what's wrong? (I'm using lighttpd)

5. Hélio Padrão Says:
   February 7th, 2014 at 03:06:45

   It worked, congratulations.

6. Vacharaphol Says:
   April 18th, 2014 at 05:40:58

   Hi! Ognyan

   I got an error \"com.android.volley.NoConnectionError: javax.net.ssl.SSLPeerUnverifiedException: No peer certificate\" after using Volley.newRequestQueue(getApplicationContext(), new ExtHttpClientStack(new SslHttpClient(keyStore, \"android\", 443))) call to \"https://www.maywebsite.com:443/abcd/login.php\"

   Do you have any suggestion?

7. Ogi Bankov / Огнян Банков Says:
   April 18th, 2014 at 06:15:27

   @Vacharaphol
   Are you using self-signed certificate?
   Probably it will the best to post the question on http://stackoverflow.com along with more info (like code snippet, type of the certificate, etc). That way more people will see it and will be able to help.

8. Vacharaphol Says:
   April 19th, 2014 at 02:53:16

   Thanks

9. Vacharaphol Says:
   April 20th, 2014 at 04:03:31

   I think my problem may come from Apache Virtual Host. I try to get public key using openssl like this "openssl s_client -connect http://www.mywebsite.com:443/abcd/login.php>myweb.pem" and I got another public key.

   Do you have any solution to solve this problem?

10. Ogi Bankov / Огнян Банков Says:
    April 20th, 2014 at 03:39:37

    @Vacharaphol
    The problem is that by default Apache can have only one SSL certificate per IP per port so in your case the problem is that you are not getting the correct certificate becase there is another virtual host that uses the same IP and port. The solution is to add another HTTPS port in apache's ports.conf for example 44301 and then declare your virtualhost like:
    <VirtualHost 10.42.0.1:44301>
    You will need to replace the IP.
    Restart apache and try to get the certificate again but this time using port 44301 like:
    openssl s_client -connect http://www.mywebsite.com:443/ > myweb.pem

11. Vacharaphol Says:
    April 24th, 2014 at 04:06:57

    Here is my code…

    {{{

    Runnable r = new Runnable() {

    public void run() {
    try {

    Log.d(TAG, "Get POST data");
    // post parameter
    Map params = new LinkedHashMap();
    params.put("email", email);
    params.put("password", password);

    StringBuilder postData = new StringBuilder();
    for (Map.Entry param : params.entrySet()) {
    if (postData.length() != 0) postData.append('&');
    postData.append(URLEncoder.encode(param.getKey(), "UTF-8"));
    postData.append('=');
    postData.append(URLEncoder.encode(String.valueOf(param.getValue()), "UTF-8"));
    }
    byte[] postDataBytes = postData.toString().getBytes("UTF-8");

    Log.d(TAG, "Load CA from keystore");
    CertificateFactory cf = CertificateFactory.getInstance("X.509");
    // use certify which get by by use google chrome
    InputStream caInput = getResources().openRawResource(R.raw.xxx);
    Certificate ca;
    try {
    ca = cf.generateCertificate(caInput);
    Log.d(TAG, "ca=" + ((X509Certificate) ca).getSubjectDN());
    } finally {
    caInput.close();
    }
    Log.d(TAG, "Load CA from keystore finish!!");

    // Create a KeyStore containing our trusted CAs
    String keyStoreType = KeyStore.getDefaultType();
    KeyStore keyStore = KeyStore.getInstance(keyStoreType);
    keyStore.load(null, null);
    keyStore.setCertificateEntry("ca", ca);

    // Create a TrustManager that trusts the CAs in our KeyStore
    String tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
    TrustManagerFactory tmf = TrustManagerFactory.getInstance(tmfAlgorithm);
    tmf.init(keyStore);

    // Create an SSLContext that uses our TrustManager
    SSLContext context = SSLContext.getInstance("TLS");
    context.init(null, tmf.getTrustManagers(), null);

    URL url = new URL("https://www.xxx.com/login.php");
    HttpsURLConnection urlConnection = (HttpsURLConnection)url.openConnection();
    urlConnection.setSSLSocketFactory(context.getSocketFactory());

    urlConnection.setRequestMethod("POST");
    urlConnection.setRequestProperty("Content-Type", "application/x-www-form-urlencoded");
    urlConnection.setRequestProperty("Content-Length", String.valueOf(postDataBytes.length));
    urlConnection.setDoOutput(true);
    urlConnection.getOutputStream().write(postDataBytes);
    String line;
    StringBuilder sb = new StringBuilder();
    BufferedReader in = new BufferedReader(new InputStreamReader(urlConnection.getInputStream(), "UTF-8"));
    try {
    while ((line = in.readLine()) != null) {
    sb.append(line);
    }
    } finally {
    if (in != null) {
    in.close();
    }
    }
    Log.d(TAG, sb.toString());
    Log.d(TAG, url.toString());
    Log.d(TAG, "OK! ");
    } catch(Exception e) {
    Log.d(TAG, e.getMessage());
    }
    }

    };
    Thread t = new Thread(r);
    t.start();

    }}}

12. anthony Says:
    February 3rd, 2015 at 02:18:06

    Hi,

    thanks it work. But if i want to mutual auth ? how can i do that? because i try but not work

13. Ogi Bankov / Огнян Банков Says:
    February 3rd, 2015 at 02:33:02

    @anthony
    I am afraid that I don't know -- never tryed it…

14. anthony Says:
    February 3rd, 2015 at 06:40:14

    Thanks! i fixed! and now works with mutual auth!!perfect!