All geek questions in one place

Invalid / Self-Signed Certificates Browser Behavior

It looks like I already searched the entire network, but all I found was advice on how to automatically accept an invalid or self-signed certificate. (Using custom HttpClient and SSLSocketFactory - I already got this working.)

But what I want for my application is that the user receives a browser dialog asking for something like "Do you really want to trust this server? Look at its certificate here." (But only if the certificate is not trusted by default.)

Then the certificate must be placed in the application certificate store, so the next time it will be accepted automatically.

So what I need to know:

  • How to upload a certificate (chain) for a specific host / port combination (to show it to the user)?
  • How to save a certificate so that I can later upload it to KeyStore ?

This is my planned workflow in the application:

  • Send a request to the server with my custom HttpClient . Perhaps the certificate is entrusted to the system or already in my store (if so, go to 4).
  • If the request fails due to SSL issues, show the user a certificate and ask if you want to trust this connection.
  • If the user decided to trust, save the certificate in my store and go to 1.
  • Hooray, the compound is ready to use.

So does anyone know how to do this?

+6
source share
1 answer

Do not disable CA verification and exclusion when trying to connect to a non-CA certificate. When you catch an exception, run your page for the user to accept / reject. If it accepts, then starting a new connection with CA checks is disabled.

0
source

Source: https://habr.com/ru/post/949384/

More articles:


All Articles