mardi 14 juin 2016

OkHttpClient and Certificate Authority Validation in Android

I am using OkHttpClient (by squareup) to make rest api calls in my android app. When a HTTPS url is used, does OkHttpClient use the android system's Trusted Certificates (found in Settings -> Security -> Trusted Credentials) ?
Because I am observing these 2 things :

  1. The certificate in the server is one issued by Amazon, which in turn is issued by Starfield Class 2 Certification Authority. The later is added in the android system's list of trusted CAs. But the connection with server works even after I disable Starfield Class 2 Certification Authority in the android system.
    So, I think OkHttpClient is not using android system's trusted CAs to validate the certificate given by server??
  2. I tried with another certificate, this time issued by StarCom Class 1 Dv CA, which in turn is issued by StarCom Certification Authority. The later is present in android system's trusted CA and is enabled. But still the SSL handshake fails with the reason javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.


Can anyone explain what is happening?

Aucun commentaire:

Enregistrer un commentaire