创建从Java客户端（在Android上）到Python服务器的自签名SSL套接字

Question

I created a self-signed certificate (server.crt, server.key, server.p12). I get a Python-Python SSL socket connection using this self-signed certificate working just fine.

Python server:

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind(('', 10023))
s.listen(5)
s_, fromaddr = s.accept()
connstream = ssl.wrap_socket(s_,
                             server_side=True,
                             certfile="server.crt",
                             keyfile="server.key")
data = connstream.read()
...

Now, I would like my Android application to talk with my Python server. I can get a non SSL connection going. I'm not sure how to proceed with self-signed certificates. My understanding is that I have to store the certificate in Java's truststore. I am having difficulty finding examples of doing this within the Android app (programmatically) using a trusted certificate file (eg the crt?). Obviously, the scope of this trust is limited to the app only, and is not intended to be a permanent solution.

Java client (on Android):

SSLSocketFactory ssf = (SSLSocketFactory) SSLSocketFactory.getDefault();
Socket socket = ssf.createSocket(HOST, PORT);
PrintWriter out = new PrintWriter(socket.getOutputStream(), true);
out.println("hello from java!");
out.flush();
...

When I try to connect I get the following error on the server:

ssl.SSLError: [Errno 1] _ssl.c:499: error:14094416:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate unknown

Answer 1

• export crt file at server
• import crt file from asserts or file at Android code
• set up crt with TrustManagerFactory at Android code
• init SSLContext with TrustManagerFactory

this is reference on official document