How to Bypass Untrusted Server Certificates When Establishing HTTPS Connections on Android?

HTTPS Connection Establishment on Android

When attempting to establish an HTTPS connection on Android, developers may encounter an exception related to an untrusted server certificate. To address this, one may consider accepting the server certificate.

Trust All Hosts

One approach to bypass certificate verification is to trust all hosts, effectively disabling the check. This can be achieved by implementing a custom HostnameVerifier and a TrustManager.

// Hostname verifier that always returns true
HostnameVerifier DO_NOT_VERIFY = new HostnameVerifier() {
    @Override
    public boolean verify(String hostname, SSLSession session) {
        return true;
    }
};

// Trust manager that accepts all certificates
TrustManager[] trustAllCerts = new TrustManager[]{
    new X509TrustManager() {
        @Override
        public X509Certificate[] getAcceptedIssuers() {
            return new X509Certificate[]{};
        }

        @Override
        public void checkClientTrusted(X509Certificate[] chain, String authType) {}

        @Override
        public void checkServerTrusted(X509Certificate[] chain, String authType) {}
    }
};

Next, initialize the SSLContext and apply the trust manager and hostname verifier.

SSLContext sc = SSLContext.getInstance("TLS");
sc.init(null, trustAllCerts, new SecureRandom());
HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());

Example Usage

When creating an HTTP connection, check the protocol and apply the aforementioned configuration if it's HTTPS.

HttpURLConnection http = null;
String url = "https://example.com";

if (url.toLowerCase().equals("https")) {
    trustAllHosts();
    HttpsURLConnection https = (HttpsURLConnection) url.openConnection();
    https.setHostnameVerifier(DO_NOT_VERIFY);
    http = https;
} else {
    http = (HttpURLConnection) url.openConnection();
}

The above is the detailed content of How to Bypass Untrusted Server Certificates When Establishing HTTPS Connections on Android?. For more information, please follow other related articles on the PHP Chinese website!