Disable SSL certificate validation of HTTPS connection? [duplicate]

Question

When I want to open an HTTPS connection I get SSL Exception. How to set HttpURLConnection in a way to doesn't be sensitive to this exception?

My code is:

private String getData() { String response = null; String connection = "https://www.kamalan.com/"; try { URL url = new URL(connection); Log.i(TAG, "Try to open: " + connection); HttpURLConnection conn = (HttpURLConnection) url.openConnection(); int responseCode = conn.getResponseCode(); Log.i(TAG, "Response code is: " + responseCode); if (responseCode == HttpURLConnection.HTTP_OK) { BufferedReader in = new BufferedReader(new InputStreamReader(conn.getInputStream())); if (in != null) { StringBuilder strBuilder = new StringBuilder(); int ch = 0; while ((ch = in.read()) != -1) strBuilder.append((char) ch); // get returned message and show it response = strBuilder.toString(); Log.i("JSON returned by server:", response); } in.close(); } else { Log.e(TAG, "Couldn't open connection in getResepiItems()"); } } catch (SSLException e) { e.printStackTrace(); } catch (IOException e) { e.printStackTrace(); } return response; }

@Morrison Chang This is the error in log cat Caused by: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found. — RajaReddy PolamReddy
– RajaReddy PolamReddy, Commented Aug 29, 2012 at 4:10
Have you see this SO post:stackoverflow.com/questions/6825226/… ? — Morrison Chang
– Morrison Chang, Commented Aug 29, 2012 at 4:32
thanks Morrison and Raja, I changed my method from opening connection to loading into webView and getting data over there. However thanks for your suggestion. If I back to above method then I'll test it. — Hesam
– Hesam, Commented Aug 29, 2012 at 5:01
@Hesam Don't. It is insecure. Solve the certificate deployment problem, don't just wire a bypass around it. Certificate checking is a critical part of SSL security. — user207421
– user207421, Commented Aug 29, 2012 at 5:10
@Hesam You are mistaken. You cannot solve a certificate problem with HTTP keep-alive. — user207421
– user207421, Commented Jun 5, 2016 at 9:48

user207421 · Accepted Answer · 2016-05-05 10:03:22Z

Follow the below method, it works for me.

 URL url = new URL("Your URL"); HttpsURLConnection urlConnection =(HttpsURLConnection) url.openConnection(); urlConnection.setSSLSocketFactory(SSLCertificateSocketFactory.getInsecure(0, null)); urlConnection.setHostnameVerifier(getHostnameVerifier()); InputStream is = urlConnection.getInputStream(); OutputStream os = new FileOutputStream(downloadedFile); byte[] data = new byte[1024]; int count; while ((count = is.read(data)) != -1) { os.write(data, 0, count); } os.flush(); os.close(); is.close();

The below method for set the Hostname

private HostnameVerifier getHostnameVerifier() { HostnameVerifier hostnameVerifier = new HostnameVerifier() { @Override public boolean verify(String hostname, SSLSession session) { HostnameVerifier hv = HttpsURLConnection.getDefaultHostnameVerifier(); return hv.verify("com.example.com", session); } }; return hostnameVerifier; }

It works how? And why? All this nonsense amounts to nothing more than verifying the session against a fixed hostname. The point, if there is one, is not stated. Don't use quote formatting for text that isn't quoted,

Collectives™ on Stack Overflow

Disable SSL certificate validation of HTTPS connection? [duplicate]

1 Answer 1

1 Comment

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Linked

Related