在Android-J2SE上使用SSL与服务器客户端套接字通信

Question

I am making a very small scale application with server - client model where server is a j2se application and client is a android application.

The server would be hosted with Dynamic DNS and needs to be portable as in changing domain name.

Now with SSL this could be problematic as the certificate is required to have a identifiable server address , either domain name or IP , both of which might change. I assume it is to prevent someone from masquerading as the server sending the same public key from a different location.

So how should I cope with this situation?

Answer 1

Below would be the hint to proceed. Add a custom trust manager for connections which validate the certificate of the server - and add a custom host name verification logic which evaluates the host name to be from the acceptable list - or just hardcode to true.

        SSLContext ctx = SSLContext.getInstance("TLS");
        TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        tmf.init(getTrustedCert());//todo
        ctx.init(null, tmf.getTrustManagers(), null);

        HttpsURLConnection.setDefaultSSLSocketFactory(ctx.getSocketFactory());

        HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier() {  
            @Override
            public boolean verify(String arg0, SSLSession arg1) {
                return isInAcceptableHostNameList(arg0);//todo
            }
        });

From docs -

This class uses HostnameVerifier and SSLSocketFactory. There are default implementations defined for both classes. However, the implementations can be replaced on a per-class (static) or per-instance basis. All new HttpsURLConnections instances will be assigned the "default" static values at instance creation, but they can be overriden by calling the appropriate per-instance set method(s) before connecting.