5

I am trying to query a HTTPS website with Apache's HttpClient 4.X from an android app. I get an javax.net.ssl.SSLPeerUnverifiedException: No peer certificate exception. I followed different instructions on importing the certificates:

None of these worked for me.

I think my problem is that the site's Certificate chain is as follows:

  • Telekom Root CA 2
    • Intermediate A
      • Intermediate B
        • Site's certificate

The Telekom Root CA 2 is included in the Android default keystore (/system/etc/security/cacerts.bks). I checked that on my own phone I use for testing.

Now the question is, which certificates do I have to include in the custom keystore all the instructions tell me to provide? Just the intermediates? Only the site? Both? Do I need the Root certificate as well? Shouldn't the Site's certificate be verified by the chain - I would not need to provide any extra certificates since the root of the chain is trusted.

I would be happy if you could explain to me what is going on and how I could get this to work. Please do not post workarounds which just ignore the Certificates, since this is intended for production and has to be secure.

Community
  • 1
  • 1
opatut
  • 6,708
  • 5
  • 32
  • 37

1 Answers1

3

I wrote a blog post, including a full working example a while back about how to do exactly this. See http://chariotsolutions.com/blog/post/https-with-client-certificates-on/

(Code from that blog post on GitHub)

Jan Doggen
  • 8,799
  • 13
  • 70
  • 144
GreyBeardedGeek
  • 29,460
  • 2
  • 47
  • 67