way to Ignore ssl certificate using HttpsURLConnection

Question

I use two approaches to try to consumes HTTPS URL:

The old deprecated and return response with the right values.

Here is the code it didn't need ignore ssl certificate it ignore it by itself or may use other technique:

public String newApiPost(String url,String p1,String p2,String p3){

    HttpClient httpClient = new DefaultHttpClient();
    // replace with your url
    HttpPost httpPost = new HttpPost(url);

    //Post Data
    List<NameValuePair> nameValuePair = new ArrayList<NameValuePair>();
    nameValuePair.add(new BasicNameValuePair("cliend_id",p1));
    nameValuePair.add(new BasicNameValuePair("client_secret", p2));
    nameValuePair.add(new BasicNameValuePair("key",p3));

    //Encoding POST data
    try {
        httpPost.setEntity(new UrlEncodedFormEntity(nameValuePair));
    } catch (UnsupportedEncodingException e) {
        // log exception
        e.printStackTrace();
    }

    //making POST request.
    try {
        HttpResponse response = httpClient.execute(httpPost);
        HttpEntity httpEntity = response.getEntity();
        String   result = EntityUtils.toString(httpEntity,     
        HTTP.UTF_8);
        Log.d("response", result);

        // write response to log
        Log.d("zzuu", result.toString());
    } catch (ClientProtocolException e) {
        // Log exception
        e.printStackTrace();
    } catch (IOException e) {
        // Log exception
        e.printStackTrace();
        Log.d("dddfg", e.toString());
    }catch (Exception e){
        Log.d("dddfg", e.toString());
    }

    return "";
 }

Then I used un-deprecated method HttpsUrlConnections which need ignore ssl certificate I use many way but didn't work:

public void sendNew (String urls,String paramValue1,String paramValue2,String paramValue3){
    URL url = null;
    BufferedReader reader = null;
    StringBuilder stringBuilder;
    String data="";

    try {
        url = new URL(urls);
        HttpsURLConnection conn = (HttpsURLConnection) url.openConnection();

        conn.setReadTimeout(10000);
        conn.setConnectTimeout(15000);
        conn.setRequestMethod("POST");
        conn.setRequestProperty("Content-Type", "application/x-www-form-urlencoded");
        conn.setRequestProperty("charset", "utf-8");
        conn.setDoInput(true);
        conn.setDoOutput(true);
        Uri.Builder builder = new Uri.Builder()
                .appendQueryParameter("cliend_id", paramValue1)
                .appendQueryParameter("client_secret", paramValue2)
                .appendQueryParameter("apikey", paramValue3);
        String query = builder.build().getEncodedQuery();

        OutputStream os = conn.getOutputStream();
        BufferedWriter writer = new BufferedWriter(new OutputStreamWriter(os, "UTF-8"));
        writer.write(query);
        writer.flush();
        writer.close();
        os.close();

        conn.connect();

        reader = new BufferedReader(new InputStreamReader(conn.getErrorStream()));
        stringBuilder = new StringBuilder();

        String line = null;
        while ((line = reader.readLine()) != null) {
            stringBuilder.append(line + "\n");
        }
        data= stringBuilder.toString();
        Log.d("zzuu", data);

    } catch (MalformedURLException e) {
        e.printStackTrace();
    } catch (ProtocolException e) {
        e.printStackTrace();
        Log.d("dddfg", e.toString());

    } catch (IOException e) {
        e.printStackTrace();
        Log.d("dddfg", e.toString());

    }catch (Exception e){
        Log.d("dddfg", e.toString());

    }
}

It responds with this error:

10-12 17:06:06.135  16052-16075/  W/System.err﹕ java.io.IOException: Hostname 'xxxxxxxx' was not verified
10-12 17:06:06.139  16052-16075/  W/System.err﹕ at libcore.net.http.HttpConnection.verifySecureSocketHostname(HttpConnection.java:223)
10-12 17:06:06.139  16052-16075/  W/System.err﹕ at libcore.net.http.HttpsURLConnectionImpl$HttpsEngine.connect(HttpsURLConnectionImpl.java:446)
10-12 17:06:06.139  16052-16075/  W/System.err﹕ at libcore.net.http.HttpEngine.sendSocketRequest(HttpEngine.java:290)
10-12 17:06:06.170  16052-16075/  W/System.err﹕ at libcore.net.http.HttpEngine.sendRequest(HttpEngine.java:240)
10-12 17:06:06.171  16052-16075/  W/System.err﹕ at libcore.net.http.HttpURLConnectionImpl.getResponse(HttpURLConnectionImpl.java:292)
10-12 17:06:06.175  16052-16075/ W/System.err﹕ at libcore.net.http.HttpURLConnectionImpl.getInputStream(HttpURLConnectionImpl.java:185)
10-12 17:06:06.175  16052-16075/  W/System.err﹕ at libcore.net.http.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:271)
10-12 17:06:06.176  16052-16075/  W/System.err﹕ at ubicall.sand.ubicall.helper.JSONParser.method(JSONParser.java:422)
10-12 17:06:06.177  16052-16075/  W/System.err﹕ at ubicall.sand.ubicall.activity.SplashActivity$Access.doInBackground(SplashActivity.java:111)
10-12 17:06:06.177  16052-16075/  W/System.err﹕ at ubicall.sand.ubicall.activity.SplashActivity$Access.doInBackground(SplashActivity.java:106)
10-12 17:06:06.177  16052-16075/  W/System.err﹕ at android.os.AsyncTask$2.call(AsyncTask.java:287)

I didn't understand when problem exactly it work good in restclient and postman the data send in body of url using post method then I discover that I need ignore ssl certificate when using HttpsURLConnection but I try many way to ignore but didn't work

I use

private void trustEveryone() {
    try {
        HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier(){
            public boolean verify(String hostname, SSLSession session) {
                return true;
            }
        });
        SSLContext context = SSLContext.getInstance("TLS");
        context.init(null, new X509TrustManager[]{new X509TrustManager(){
            public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {}
            public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {}
            public X509Certificate[] getAcceptedIssuers() {
                return new X509Certificate[0];
            }
        }}, new SecureRandom());
        HttpsURLConnection.setDefaultSSLSocketFactory(
        context.getSocketFactory());
    } catch (Exception e) { // should never happen
        e.printStackTrace();
    }
}

Looks like a certificate issue. Look here for more info: https://developer.android.com/training/articles/security-ssl.html#CommonHostnameProbs — Damien O'Reilly, Oct 12 '15 at 15:37
thanks for reply is it normal work in Postman and didn't work in android — androidAhmed, Oct 12 '15 at 15:48
URLConnection is preferable to HttpClient. Have a look into http://stackoverflow.com/questions/32591295/subsequent-https-post-request-in-java-with-cookies-retained/32592521#32592521 — Ravindra babu, Oct 12 '15 at 15:48
http://stackoverflow.com/questions/2793150/using-java-net-urlconnection-to-fire-and-handle-http-requests/32781880#32781880 and https://github.com/loopj/android-async-http/issues/75 prefer HttpURLConnection — Ravindra babu, Oct 12 '15 at 15:57

score 12 · Accepted Answer · edited May 23 '17 at 12:08

12

From your logcat information, I think you should read the following links:

HostnameVerifier

It is to be used during a handshake if the URL's hostname does not match the peer's identification hostname.
Common Problems with Hostname Verification

One reason this can happen is due to a server configuration error. The server is configured with a certificate that does not have a subject or subject alternative name fields that match the server you are trying to reach...

Then, you can refer to my answer to the following question:

OkHttp trusting certificate

EDIT: Relating to your idea 'ignore ssl', you can try the following (however, it's said that this is not recommended):

public class HttpsTrustManager implements X509TrustManager {
    private static TrustManager[] trustManagers;
    private static final X509Certificate[] _AcceptedIssuers = new X509Certificate[]{};

    @Override
    public void checkClientTrusted(
            X509Certificate[] x509Certificates, String s)
            throws java.security.cert.CertificateException {

    }

    @Override
    public void checkServerTrusted(
            X509Certificate[] x509Certificates, String s)
            throws java.security.cert.CertificateException {

    }

    public boolean isClientTrusted(X509Certificate[] chain) {
        return true;
    }

    public boolean isServerTrusted(X509Certificate[] chain) {
        return true;
    }

    @Override
    public X509Certificate[] getAcceptedIssuers() {
        return _AcceptedIssuers;
    }

    public static void allowAllSSL() {
        HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier() {

            @Override
            public boolean verify(String arg0, SSLSession arg1) {
                return true;
            }

        });

        SSLContext context = null;
        if (trustManagers == null) {
            trustManagers = new TrustManager[]{new HttpsTrustManager()};
        }

        try {
            context = SSLContext.getInstance("TLS");
            context.init(null, trustManagers, new SecureRandom());
        } catch (NoSuchAlgorithmException | KeyManagementException e) {
            e.printStackTrace();
        }

        HttpsURLConnection.setDefaultSSLSocketFactory(context != null ? context.getSocketFactory() : null);
    }
}

Then, in your activity, call HttpsTrustManager.allowAllSSL();

edited May 23 '17 at 12:08

Community

1
1

answered Oct 13 '15 at 14:05

BNK

23,994
8
77
87

thanks for your reply after I discuss with the server developer they request ignore the ssl certificate I try http://stackoverflow.com/a/5297100/3311983 but didn't work – androidAhmed Oct 13 '15 at 14:41
no I try to ignore the ssl and try many method the problem that I didn't know when call this method after instiate HttpsURLConnection or after I try the both and return errors – androidAhmed Oct 13 '15 at 14:44
Have you read my answer at the following link http://stackoverflow.com/questions/33067368/okhttp-trusting-certificate yet? After creating hostnameverifier, you can setHostnameVerifier for your httpsurlconnection – BNK Oct 13 '15 at 14:46
If error still occurs, pls post new logcat because I think another exception can be thrown, such as "trust anchor not found"... – BNK Oct 13 '15 at 14:47
return exception with java.lang.NullPointerException: lock == null – androidAhmed Oct 13 '15 at 14:54
the error in log is java.lang.NullPointerException: lock == null after using this method http://stackoverflow.com/a/5297100/3311983 – androidAhmed Oct 13 '15 at 15:06
For sslsocketfactory, you need cert file/keystore file in your project. – BNK Oct 13 '15 at 15:15
Read my answer at the following link http://stackoverflow.com/questions/32154115/android-volley-self-signed-https-trust-anchor-for-certification-path-not-found – BNK Oct 13 '15 at 15:18
thanks a lot for your reply I want to ignore check for certificate can you give me a valid example for this and thanks – androidAhmed Oct 14 '15 at 13:31
Sorry I dont know really, or you use httpurlconnection instead of httpsurlconnection – BNK Oct 14 '15 at 13:33
Ah, I remember that there are some topics, you can search with keywords such as https trust all or allow all – BNK Oct 14 '15 at 13:47
Adding this to resolve issue is not acceptable by google play store as it will show Error and ask to delete this . Anything else that can be done? – S.Ambika Feb 05 '21 at 11:36

way to Ignore ssl certificate using HttpsURLConnection

1 Answers1

Linked