如何从代理后面的Android应用通过HTTPS访问服务？

Question

My Android app makes some web-service calls over HTTPS. Therefore users behind proxy (mostly in corporate networks) were unable to use the app. So I added a custom HostnameVerifier :

HostnameVerifier hostnameVerifier = new HostnameVerifier() {
                @Override
                public boolean verify(String hostname, SSLSession session) {
                    return true;
                }
};

This fixes the problem, but also sends an open invite to MITM attackers. What kind of checks should I add to the HostnameVerifier ? I also came across recommendations for using custom TrustManagers and adding my certificate there - but noone talks about what would happen if I ever update my server certificate - users won't be able to use the app unless I push an app update with new SSL certificate (and they download the app).

In a nutshell, my question is how to make an app accessible behind proxy, yet not susceptible to MITM. Or is it not possible ? If not possible, do we "leak" our passwords while accessing a banking website if using behind proxy ?

Answer 1

A simple http proxy does not make any changes to the https communication, so everything should work without changes to certificate validation as long as the proxy is used the way it should be done, ie configured as proxy for the browser and not used as special URLs like https://proxy.example.com/tunnel?site=https://site.example.org .

Then there are proxies and firewalls which do SSL interception to scan encrypted connections for malware etc. In these cases the hostname of the certificate usually matches, but the issuer is different and not trusted by the OS. In this case this issuers CA certificate has to be imported as trusted into the OS. For Android this is a central setting and does not depend on the application.

Never ever you should simple disable parts of the certificate validation to make it easier for the user, because you then open your application against man-in-the-middle attacks. If a proxy is used the intended way and the corporate SSL interception is explicitly trusted by the user than you are safe, if you add some special exceptions in your code then you are not.