Got SSLPeerUnverifiedException Hostname 196.1X.3X.X2 not verified error in Android 9 with Self signed certificate, but work in all other versions

Question

When Https connection is made to REST API with Self singed certificate , I got error in Android 9 that javax.net.ssl.SSLPeerUnverifiedException: Hostname 196.1X.3X.X2 not verified. But it works in Android version before Android (Pie). I put hostname is correctly. What to do ? Thanks in Advance.

My code is given below.

public static String getResponse(String url) { 
    URL updateURL  ; 
   HttpsURLConnection  connection = null; 
    try { 
        HostnameVerifier hostnameVerifier = ( hostname, session ) ->{
            HostnameVerifier hv =
                    HttpsURLConnection.getDefaultHostnameVerifier();
            return hv.verify(Common.getHostnameSubject()+"", session )  ;
        };
        updateURL = new URL(url);
        CertificateFactory cf = CertificateFactory.getInstance("X.509");

        InputStream caInput =  AppApplication.getAppContext().
                getAssets().open(Common.getCertificateAssetName());  
        Certificate ca; 
        ca = cf.generateCertificate(caInput);  
        caInput.close(); 
        String keyStoreType = KeyStore.getDefaultType();
        KeyStore keyStore = KeyStore.getInstance(keyStoreType); 
        keyStore.load(null, null);
        keyStore.setCertificateEntry("ca", ca); 
        String tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
        TrustManagerFactory tmf = TrustManagerFactory.getInstance(tmfAlgorithm);
        tmf.init(keyStore); 
        SSLContext context = SSLContext.getInstance("TLSv1.2"); 
        context.init(null, tmf.getTrustManagers(), null); 
        connection = (HttpsURLConnection) updateURL.openConnection(); 
        if( Common.isHostnameverficationManual() ) {
            connection.setHostnameVerifier(hostnameVerifier);
        }
        connection.setConnectTimeout(60000);
        connection.setSSLSocketFactory(context.getSocketFactory());
        int status = connection.getResponseCode();  
        InputStream is = new BufferedInputStream( connection.getInputStream() ); 
        BufferedReader in = new BufferedReader(new InputStreamReader(is));
        StringBuilder sb = new StringBuilder("");
        String line;
        String nl = System.getProperty("line.separator"); 
        while ((line = in.readLine()) != null) {
            sb.append(line).append(nl);
        } 
            result = sb.toString();
    } catch ( IOException | NoSuchAlgorithmException | KeyManagementException | CertificateException | KeyStoreException e ) { 
        if (connection != null) {
            connection.disconnect(); 
        }
    } 
    return result; 
}

Trần Thị Diệu My · Accepted Answer · 2019-01-05T15:27:05.867

4

Please try this code.

HttpsURLConnection.setDefaultHostnameVerifier((hostname, sslSession) -> {
    if(hostname.equals("196.1X.3X.X2")) return true;
    return false;
});

You should confirm lambda is working on your android studio environment.

edited Jan 05 '19 at 15:27

answered Jan 04 '19 at 14:45

Trần Thị Diệu My

1,323
22
23

The condition "if(hostname.equals("196.1X.3X.X2"))" is always true. Because of this, I think we didn't get the benefits of HTTPS connection(encrypted communication). Am I right? – VISHNU NEELANCHERI Jan 05 '19 at 09:20
Did you add the code and try it before calling api? – Trần Thị Diệu My Jan 05 '19 at 15:31
Yes. But the request was not verifying the host name. There is a possibility to redirected by a man in the middle attack. – VISHNU NEELANCHERI Jan 08 '19 at 11:56

Got SSLPeerUnverifiedException Hostname 196.1X.3X.X2 not verified error in Android 9 with Self signed certificate, but work in all other versions

1 Answers1