Using SSL in Android

Question

I am new to SSL. I am using the code given at https://developer.android.com/training/articles/security-ssl.html#HttpsExample and using it I am able to establish connection with my URL (verified by urlConnection.getResponseCode(), where urlConnection is of type HttpsURLConnection). Now my doubt is using this how do I ensure that I am communicating with the correct server? Without that I think there can still be MITM attack. In the link mentioned above there is some discussion about this, but I don't know how to check this using java code. Thanks for your valuable time and help.

Answer 1

To verify the right server, you've to pin the certificate. Please have a look at https://developer.android.com/training/articles/security-ssl.html#Pinning whereby a tutorial is given here http://www.thoughtcrime.org/blog/authenticity-is-broken-in-ssl-but-your-app-ha/