Android：执行URL时绕过安全证书检查

Question

I am working on Android app and as part of that, I have to connect to a HTTPS host.. This host users a security certificate that is not recognized by Android ! This is a valid certificate but it is not trusted by Android...

The system specefically raises an Security Exception: Certificate is not Trusted

My code is as shown:

Url = new URL("https://example.com");
url_connection = (HttpsURLConnection) Url.openConnection();
url_connection.connect(); // This is where the exception is raised !

Due to the exception, the connection is not open ! I want to skip the certificate verification ... OR somehow the exception should not be raised and the connection should open...

I am going to validate the certificates in next step after successful connection is made.. This is part of my app and hence during connection I want to skip this..

I have searched for similar questions, but none of the answers work for me... I have tried the approach of creating my own SSL Factory and local trust managers but it does not work at all ... I get the exception NoSuchAlgorithmException when I do the following:

ssl_context = SSLContext.getInstance("SSL"); // OR TSL for that matter..

Due to this, I am not able to proceed ... Please help..

The main issue is the exception... If the connection is made with errors or warnings, then also it is fine...

Please note: I do not want to import the certificates onto device, becuase this is not feasible solution... Otherwise all users will have to go through this manual step.. So, I want to validate the certificates programatically and make the connection...

Answer 1

Do you mean TLS? Did you actually specify TLS or was TSL a typing error?

I guess you could try other SSLContext names, see SSLContext Algorithm names but SSL or TLS should've returned something.

Answer 2

Can't you get the host certificate signed by a recognized CA? That would be a lot simpler than programming your way around it, which may introduce security risks.