How to renew SSL certificate in Android apps?

Question

I recently worked on a project that implemented SSL.

SSL certificate expires once a year. And it throws an exception to android after updating the certificate on the server.

06-13 11: 20: 27.709: D / allenj (30076): javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: the binding binding for the certification path was not found.

After I look through the project code, I saw that there is a bks file, therefore, does this mean that I have to update the bks file once a year, and I need to download the application to the Google game again.

The problem is, what is the standard way to handle updating an SSL certificate? Thanks for the help.

Code output

nnable Register_runnable = new Runnable(){ @Override public void run() { EditText emailText = (EditText) findViewById(R.id.editText1regist); EditText pwText = (EditText) findViewById(R.id.editText2registpw); String end = "\r\n"; String twoHyphens = "--"; String boundary = "*****"; try { KeyStore keyStore = KeyStore.getInstance("BKS"); InputStream in = getResources().openRawResource(R.raw.ballooncardbks); keyStore.load(in, "".toCharArray()); TrustManagerFactory tmf = TrustManagerFactory.getInstance("X509"); tmf.init(keyStore); SSLContext context = SSLContext.getInstance("TLS"); context.init(null, tmf.getTrustManagers(), null); String actionUrl = "https://app.ballooncard.com/api/client/register/format/json"; URL url = new URL(actionUrl); HttpsURLConnection con = (HttpsURLConnection) url.openConnection(); // con.setDoInput(true); con.setDoOutput(true); con.setUseCaches(false); con.setRequestMethod("POST"); con.setSSLSocketFactory(context.getSocketFactory()); con.setRequestProperty("Connection", "Keep-Alive"); con.setRequestProperty("Charset", "UTF-8"); con.setRequestProperty("Content-Type", "multipart/form-data;boundary=" + boundary); 

Answer 1

It looks like the application uses "certificate binding", which means that the certificate was hardcoded in the application, and the application was asked to accept only this certificate and others.

This increases security by requiring you to update the application when (ideally before) the certificate expires. You can follow the instructions from the message I created:

fooobar.com/questions/171006 / ...

to create a new .bks file from your certificate. Once this is done, overwrite the old .bks file and your application should successfully connect via SSL.