For this recipe, we will be importing the self-signed SSL certificate into the app, and to do this, we are going to run some terminal commands. This section will cover the tools and commands to download the SSL certificate files on your machine.

The latest version of the Bouncy Castle library is needed later in this recipe to create and import certificates into the truststore. We use Bouncy Castle as it is a robust open source cryptology library that Android has built-in support for. You'll find the bcprov.jar file at http://www.bouncycastle.org/latest_releases.html. Download and save it to the current working directory. For this recipe, we have saved it to a local directory called libs so the path to reference the .jar file is /libs/bcprov-jdk15on-149.jar (which is the latest version at the time of writing this book).

We will need a self-signed SSL certificate file from the server; if you created yours manually or already have it, you can skip the rest of this section and move on to the recipe.

To create or download an SSL certificate, we will need to take advantage of the open source SSL toolkit known as OpenSSL:

To get the certificates from the server in the terminal window, type the following command, where server.domain is either the IP address or server name:

Openssl s_client -showcerts -connect server.domain:443 </dev/null.

The certificate details will be displayed in the console output. Copy and paste the certificate that is defined, starting with -----BEGIN CERTIFICATE----- and ending with -----END CERTIFICATE-----, into a new file and save it as mycert.crt. It's important not to include any additional white space or trailing spaces.

The following screenshot shows an example of the Openssl –showcerts command for android.com:

If you don't have a server yet and want to create a new self-signed certificate to use, we first need to generate a private RSA key using the OpenSSL toolkit. Type the following into a terminal window:

openssl genrsa –out my_private_key.pem 2048

This creates the private key file my_private_key.pem. The next step is to generate the certificate file using the private key generated in the previous step. In the terminal, type:

openssl req -new -x509 -key my_private_key.pem -out mycert.crt -days 365

Follow the onscreen prompts and fill in the certificate details. Note the common name is typically your server IP address or domain name.

That's it for getting ready! We should have a certificate file in hand for the next section.

Let's get started!

That concludes this recipe; we can communicate with Internet resources that are protected by SSL and signed with our self-signed SSL certificate.

In general, when dealing with SSL, a common mistake is to catch and hide certificate and security exceptions. This is exactly what an attacker is relying on to dupe an unsuspecting app user. What you choose to do about SSL errors is subjective and depends on the app. However, blocking networking communications is usually a good step to ensure that data is not transmitted over a potentially compromised channel.

public class TrustAllX509TrustManager implements X509TrustManager {

  @Override
  public void checkClientTrusted(X509Certificate[] chain, String authType)
      throws CertificateException {
    // do nothing, trust all :(
  }

  @Override
  public void checkServerTrusted(X509Certificate[] chain, String authType)
      throws CertificateException {
    // do nothing, trust all :( 
  }

  @Override
  public X509Certificate[] getAcceptedIssuers() {
    return null;
  }
}