如何使Android上的NanoHTTPD接受具有专用客户端证书的客户端连接

Question

I make an web service on an Android device using NanoHTTPD. But it will trust all certificate and accept SSL connection from all client. I want to limit the access from specific client only.

Update: I try to work like this:

        String KEYSTOREPASS = "test";
        char[]ctpass = KEYSTOREPASS.toCharArray();
        KeyStore ks = KeyStore.getInstance("PKCS12");

        //Directly load cert from Resources
        //ks.load(ctx.getResources().openRawResource(R.raw.cayan_cert),kspass);

        //Or dynamically generate a cert and use it
        ipAddressInCN = MainApplication.getIPAddress();

        //Use the current IP Address to generate a cert that signed by hard coded CA, and add to keystore
        String CN = "CN=" + ipAddressInCN;
        ks.load(null, null);
        GenerateCSR.AddCertToKeyStore(ks, ctpass, CN);

        KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
        kmf.init(ks, ctpass);

        SSLContext sc = SSLContext.getInstance("TLS");

        TrustManager[] tm = new TrustManager[]{new X509TrustManager() {

            public java.security.cert.X509Certificate[] getAcceptedIssuers() {

                return new java.security.cert.X509Certificate[0];
            }

            public void checkClientTrusted(java.security.cert.X509Certificate[] certs,
                                           String authType) {
                System.out.println("abc");
                return;
            }

            public void checkServerTrusted(java.security.cert.X509Certificate[] certs,
                                           String authType) {

                return;
            }

        }};

        sc.init(kmf.getKeyManagers(), tm, null);
        server.makeSecure(sc.getServerSocketFactory(), null);

I try to set break point to my custom trust manager functions but they are never called.

Answer 1

But it will trust all certificate and accept SSL connection from all client.

Not true. It will only accept SSL connections from clients with trusted certificates, unless you have installed some brain-dead trust-all-certificates garbage, in which case you should remove them.

I want to limit the access from specific client only.

You should do that via authorization, which you have to implement yourself in NanoHTTPD.