Android app WebView How to verify the SSL certificate

Source: Internet
Author: User
Tags certificate fingerprint ssl certificate

The fragmentation of the Android system is serious, and the phone date is incorrect, the phone root certificate is abnormal, Com.google.android.webview bug and other reasons, will cause webviewclient unable to access the HTTPS site. The way SSL errors are handled is critical, and if handled improperly, can lead to man-in-the-middle attacks, hacking data and triggering security incidents.

It is particularly important to deal with onreceivedsslerror rigorously. Please refer to the following code, the principle is: If the WebView report SSL error, the program will be strong verification of the server certificate, if the server incoming certificate fingerprint (SHA256) and record value consistent, the WebView verification process is flawed (such as: Phone date error, root certificate is deleted, etc.), Ignore SSL errors, and if the certificate match fails, indicates a problem with data communication and keeps blocking.

Please click here to get the thumbprint of the certificate (SHA256) and then adjust the MySSLCNSHA256 array variable in the code. If your app needs to access multiple certificates, include multiple certificate thumbprint values in your code. When testing your code, set the date of your phone before the certificate's validity period to determine if WebView has access to the HTTPS site properly.

Webview.setwebviewclient (New Webviewclient () {@Override public void Onreceivedsslerror (WebView view, Sslerrorhandle R handler, sslerror error) {if (error.getprimaryerror () = = sslerror.ssl_date_invalid//date not correct | | error.getprimaryerror () = = sslerror.ssl_expired//Date Incorrect | | Error.getprimaryerror () = = sslerror.ssl_invalid//WebView BUG | | Error.getprimaryerror () = = sslerror.ssl_untrusted) {//Root certificate lost if (Chkmysslcncert (Error.getcertificate ())) {Hand  Ler.proceed (); If the certificate is consistent, ignore the error}}} private Boolean Chkmysslcncert (Sslcertificate cert) {byte[] MySSLCNSHA256 = {35, 76, 110  ,-121,-68,-104,-12, 84, 39, 119,-55, 101, 95,-8,-90, 9, 36,-108, 5,-57, 76,-98,-19, 73, 91,  32,-41, 0, 109};    Certificate Fingerprint Bundle bundle = sslcertificate.savestate (cert);    byte[] bytes = Bundle.getbytearray ("X509-certificate");              if (bytes! = null) {try {certificatefactory CF = Certificatefactory.getinstance ("n"); CerTificate CA = cf.generatecertificate (new Bytearrayinputsteam (bytes));            MessageDigest sha256 = messagedigest.getinstance ("SHA-256");            byte[] Key = Sha256.digest (((x509certificate) CA). getencoded ());    Return Arrays.equals (key, MySSLCNSHA256);    } catch (Exception Ex) {}} return false; }}

Original articles, reproduced please indicate the source of the article https://www.myssl.cn

Android app WebView How to verify the SSL certificate

Related Article

E-Commerce Solutions

Leverage the same tools powering the Alibaba Ecosystem

Learn more >

Apsara Conference 2019

The Rise of Data Intelligence, September 25th - 27th, Hangzhou, China

Learn more >

Alibaba Cloud Free Trial

Learn and experience the power of Alibaba Cloud with a free trial worth $300-1200 USD

Learn more >

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.