Android app WebView How to verify the SSL certificate

The fragmentation of the Android system is serious, and the phone date is incorrect, the phone root certificate is abnormal, Com.google.android.webview bug and other reasons, will cause webviewclient unable to access the HTTPS site. The way SSL errors are handled is critical, and if handled improperly, can lead to man-in-the-middle attacks, hacking data and triggering security incidents.

It is particularly important to deal with onreceivedsslerror rigorously. Please refer to the following code, the principle is: If the WebView report SSL error, the program will be strong verification of the server certificate, if the server incoming certificate fingerprint (SHA256) and record value consistent, the WebView verification process is flawed (such as: Phone date error, root certificate is deleted, etc.), Ignore SSL errors, and if the certificate match fails, indicates a problem with data communication and keeps blocking.

Please click here to get the thumbprint of the certificate (SHA256) and then adjust the MySSLCNSHA256 array variable in the code. If your app needs to access multiple certificates, include multiple certificate thumbprint values in your code. When testing your code, set the date of your phone before the certificate's validity period to determine if WebView has access to the HTTPS site properly.

Webview.setwebviewclient (New Webviewclient () {@Override public void Onreceivedsslerror (WebView view, Sslerrorhandle R handler, sslerror error) {if (error.getprimaryerror () = = sslerror.ssl_date_invalid//date not correct | | error.getprimaryerror () = = sslerror.ssl_expired//Date Incorrect | | Error.getprimaryerror () = = sslerror.ssl_invalid//WebView BUG | | Error.getprimaryerror () = = sslerror.ssl_untrusted) {//Root certificate lost if (Chkmysslcncert (Error.getcertificate ())) {Hand  Ler.proceed (); If the certificate is consistent, ignore the error}}} private Boolean Chkmysslcncert (Sslcertificate cert) {byte[] MySSLCNSHA256 = {35, 76, 110  ,-121,-68,-104,-12, 84, 39, 119,-55, 101, 95,-8,-90, 9, 36,-108, 5,-57, 76,-98,-19, 73, 91,  32,-41, 0, 109};    Certificate Fingerprint Bundle bundle = sslcertificate.savestate (cert);    byte[] bytes = Bundle.getbytearray ("X509-certificate");              if (bytes! = null) {try {certificatefactory CF = Certificatefactory.getinstance ("n"); CerTificate CA = cf.generatecertificate (new Bytearrayinputsteam (bytes));            MessageDigest sha256 = messagedigest.getinstance ("SHA-256");            byte[] Key = Sha256.digest (((x509certificate) CA). getencoded ());    Return Arrays.equals (key, MySSLCNSHA256);    } catch (Exception Ex) {}} return false; }}

Original articles, reproduced please indicate the source of the article https://www.myssl.cn

Android app WebView How to verify the SSL certificate