TrustManagerFactory and setting the SSLSocketFactory

Question

I have a SSLSocketFactory and a TrustManagerFactory as shown below:

TrustManagerFactory tmf = TrustManagerFactory.getInstance("X509"); tmf.init(trustStore); LogUtils.log("SSL: did init TrustManagerFactory with trust keyStore"); SSLContext context = SSLContext.getInstance("TLS"); context.init(null, tmf.getTrustManagers(), null); urlConnection.setSSLSocketFactory(context.getSocketFactory());

What are the implications of setting the context TrustManagers to null?

so

changing:

context.init(null, tmf.getTrustManagers(), null);

to this:

context.init(null, null, null);

null for the trust manager will use the default TrustManager, which might not be an "X509" TM (it's "PKIX" in recent versions of Oracle JREs, not sure about Android), and which might be initialised with a different trust store (since your code doesn't show where you've loaded it from). — Bruno
– Bruno, Commented Jan 24, 2014 at 9:58

AggelosK · Accepted Answer · 2014-01-24 07:42:07Z

In Java api documentation it provides more details about the method javax.net.ssl.SSLContext.init(KeyManager[] km, TrustManager[] tm, SecureRandom random). Assuming that the Android framework has not changed the implementation, passing null for the tm input will use the Android preinstalled trust managers for the server SSL certificate acceptance.

Collectives™ on Stack Overflow

TrustManagerFactory and setting the SSLSocketFactory

1 Answer 1

Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Related