2

Hi I have a situation where I want to remove SSL pinning on the Android app.

Here is the code I have which does the SSL pinning.

private AsyncHttpClient m_asyncHttpClient;
m_asyncHttpClient.setSSLSocketFactory(getSSLSocketFactory());

private static SSLSocketFactory getSSLSocketFactory(){
    try {
        // Get an instance of the Bouncy Castle KeyStore format
        KeyStore trusted = KeyStore.getInstance("BKS");
        // Get the raw resource, which contains the pinnedcert with
        // your trusted certificates (root and any intermediate certs)
        InputStream in = DPApp.getInstance().getResources().openRawResource(R.raw.XXXXX);
        try {
            // Initialize the pinnedcert with the provided trusted certificates
            // Also provide the password of the pinnedcert
            trusted.load(in, "XXX".toCharArray());
            trusted.size();
        } finally {
            in.close();
        }
        // Pass the pinnedcert to the SSLSocketFactory. The factory is responsible
        // for the verification of the server certificate.
        SSLSocketFactory sf = new SSLSocketFactory(trusted);
        // Hostname verification from certificate
        // http://hc.apache.org/httpcomponents-client-ga/tutorial/html/connmgmt.html#d4e506
        sf.setHostnameVerifier(SSLSocketFactory.STRICT_HOSTNAME_VERIFIER);
        return sf;
    } catch (Exception e) {
        throw new AssertionError(e);
    }
}

I tried to comment the setSSLSocketFactory line but that gave me an error

java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.

I know server certificate has expired but for now I just want to remove SSL pinning from the app.

Any suggestions on what is the best way to do that from the Android code please.

BRDroid
  • 3,920
  • 8
  • 65
  • 143

0 Answers0