Android encounters HTTPS

HTTPS, the total to come.
Recent leadership on mobile development has put forward a lot of optimization requirements Ah! One point is the data security, before the Android backend interface has been used HTTP, then I think, HTTPS should be the entry-level, hurriedly find information to organize the next!
For the network address that has applied for the certificate to the authority, it can be accessed directly with Okhttp or httpsurlconnection, and there is no need to do anything extra. But the application certificate to $$, so when the development of our interface is often the use of self-signed certificates, or even on-line or with self-signed, because the basic use of Android is the data interface, and will not be accessed by the browser, do not want to pay the money!

Accessing a self-signed URL
Generate a certificate using Keytool
Keytool is an easy tool for the JDK to manage encryption keys, the certificates chain, and the trusted certificate KeyStore. Android development must have a JDK installed and will generally be configured with environment variables, so you can enter the Keytool command directly in the Terminal or Doc window to see the Help.

1. Generate a key pair

1
Keytool-genkey-alias Server-keyalg Rsa-keystore Server.jks
-alias followed by a unique alias,-keystore after the file path to save the key pair
You can also add a-validity days declaration validity period

Note: After executing the command, the first question lets you enter the name of the place is preferably set to a domain name, such as baidu.com or so localhost, anyway, matching the domain you want to tune the right, of course, if you debug on Android, then the local address may not be used.

2. Export the certificate

The above generates a key pair used by the server, which can now be used to generate a certificate for the client

1
Keytool-export-alias server-storepass 123456-keystore server.jks-file server.cer
-storepass behind with is you just set the password, do not add this also does not matter, it will ask you voluntarily! -file set the path to save the certificate

Server-side configuration
Here I use TOMCAT8 to test, its configuration is very simple, modify the Tomcat directory under the Conf/server.xml file, add the following, here set the port number is 8443

<connector port= "8443" protocol= "Org.apache.coyote.http11.Http11NioProtocol"
Maxthreads= "sslenabled=" true "scheme=" "https" secure= "true"
Clientauth= "false" sslprotocol= "TLS"
keystorefile= "KeyStore file path, i.e.. jks file"
keystorepass= "Password"/>
Android configuration
Load Certificate
To put the previously generated certificate (. cer) into the assets or raw directory of the Android project, read the file stream to get the sslsocketfactory in the following way.

public static Sslsocketfactory Getsslsocketfactory (InputStream certificates)
{
Sslcontext sslcontext = null;
Try
{
Certificatefactory certificatefactory = certificatefactory.getinstance ("n");

  Certificate CA;        try {CA = certificatefactory.generatecertificate (certificates);        } finally {certificates.close ();        }//Create a KeyStore containing our trusted CAs String Keystoretype = Keystore.getdefaulttype ();        KeyStore KeyStore = keystore.getinstance (Keystoretype);        Keystore.load (null, NULL);        Keystore.setcertificateentry ("Ca", CA); Create a TrustManager that trusts the CAs in our KeyStore String tmfalgorithm = trustmanagerfactory.getdefaultal        Gorithm ();        Trustmanagerfactory TMF = trustmanagerfactory.getinstance (tmfalgorithm);        Tmf.init (KeyStore);        Create an Sslcontext this uses our TrustManager Sslcontext = sslcontext.getinstance ("TLS");    Sslcontext.init (NULL, tmf.gettrustmanagers (), NULL);    } catch (Exception e) {e.printstacktrace (); } return Sslcontext! = null? Sslcontext.getsocketfactory (): null;}  

OkHttp
It's easy to use in okhttp, and it's OK to get sslsocketfactory and pass through the Okhttp build method.
The okhttp version used is 3.2.0.

Okhttpclient client = new Okhttpclient.builder ()
. Sslsocketfactory (Sslsocketfactory)
. build ();
After Setup you can access the domain name address of the certificate, no additional action is required.

Httpsurlconnection
The Okhttp API is very close to the URLConnection provided by default in Android, so the configuration is the same.

URL url = new URL ("https://...");

Httpsurlconnection httpsurlconnection = (httpsurlconnection) url.openconnection ();

Httpsurlconnection.setsslsocketfactory (sslsocketfactory);
Two-way verification
Two-way authentication requires two key entities, one on the server side and one for the client.
We have already implemented one-way authentication, and now we just need to generate a keystore for the client and let the server trust the client.

Generate Client Key

Keytool-genkey-alias Android-keyalg Rsa-keystore Android.jks
Export client certificate (in string form)

Keytool-keystore Android.jks-alias android-exportcert-rfc > Android.pem
Add the exported certificate to the KeyStore trusted to the server

Keytool-importcert-trustcacerts-alias Android-keystore Server.jks-file Android.pem
Server-side configuration
Modify the Conf/server.xml file under the Tomcat directory

<connector port= "8443" protocol= "Org.apache.coyote.http11.Http11NioProtocol"
Maxthreads= "sslenabled=" true "scheme=" "https" secure= "true"
Sslprotocol= "TLS"
keystorefile= "KeyStore file path, i.e.. jks file"
keystorepass= "Password"
Modify two of the content, the other is the same as the previous one-way authentication.
Clientauth= "true"
Truststorefile= "and keystorefile fill the same"/>

Android encounters HTTPS