Validate SSL Certification Java/Android

Question

I have my android application talking to the server which is protected by an SSL certificate. Below is the code for that.

final HttpPost httppost = new HttpPost("https://www.myurl.com");
final List<NameValuePair> postlist = Utils.HttpGetToHttpPost(Arguments);
httppost.setEntity(new UrlEncodedFormEntity(postlist));
final HttpResponse response = httpclient.execute(httppost);

Now my question is how do I prevent a MITM attack. How do I ensure that Im talking to myurl.com and not another url.

hooknc · Accepted Answer · 2011-04-19 05:35:09Z

1

After some quick research...

Using the truststore that ships with java and using only ssl communication, might just be your best protection against Man in the Middle attacks. Java, out of the box, will throw an exception if it can't trust the certificate provided by the server.

Based on what I read it is hard for hackers to impersonate the key given to a site by a Certificate Authority.

I could be wrong though.

answered Apr 19, 2011 at 5:35

hooknc

5,0055 gold badges36 silver badges65 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Yi Zhao · Accepted Answer · 2011-04-19 04:23:08Z

1

You could restrict the HTTPS hostname verify in this way:

SSLSocketFactory sf = new SSLSocketFactory(SSLContext.getInstance("TLS"));
sf.setHostnameVerifier(SSLSocketFactory.STRICT_HOSTNAME_VERIFIER);

Please refer to JSSE Reference Guide for detail customization with Java SSL connection.

answered Apr 19, 2011 at 4:23

Yi Zhao

6,7841 gold badge20 silver badges18 bronze badges

Collectives™ on Stack Overflow

Validate SSL Certification Java/Android

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related