1

So its a simple enough question but I'm not sure of the answer.

Developing SSL on android is a tricky area at times. Most people are left with two options: * Accept all certificates and risk MITM attacks * Package the cert as a BKS in the application.

In my apps case, I opted to package the BKS inside and read it through a HttpsURLConnection

KeyStore trustStore = loadTrustStore();
KeyStore keyStore = loadKeyStore();

TrustManagerFactory tmf = TrustManagerFactory
                    .getInstance(TrustManagerFactory.getDefaultAlgorithm());
tmf.init(trustStore);

KeyManagerFactory kmf = KeyManagerFactory
                    .getInstance(KeyManagerFactory.getDefaultAlgorithm());
kmf.init(keyStore, KEYSTORE_PASSWORD.toCharArray());

SSLContext sslCtx = SSLContext.getInstance("TLS");
sslCtx.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);

URL url = new URL("https://myserver.com");
HttpsURLConnection urlConnection = (HttpsURLConnection) url
urlConnection.setSSLSocketFactory(sslCtx.getSocketFactory());

Now I've hit a bump. My certificate is fast expiring and I'm not sure the effect it will have if I upgrade it.

Q: Will renewing the SSL cert without upgrading the app on Android devices stop them from accessing the https URLs?

Q: What are the implications of not upgrading the SSL cert. Will the Android devices not be able to contact the server

Rooktone
  • 109
  • 1
  • 5
  • yes. Support both certs for a period of time to work around the issue. – Anya Shenanigans Apr 03 '13 at 14:12
  • @Petesh Hi Petesh. Thanks for the comment. About supproting the older cert, I have updated my question. Will the Android devices still be able to contact the server after the certificate expires? – Rooktone Apr 03 '13 at 15:34
  • it should throw a [`CertificateExpiredException`](http://docs.oracle.com/javase/7/docs/api/java/security/cert/CertificateExpiredException.html) in that case. You could probably deal with this using [the solution in this answer](http://stackoverflow.com/questions/8693991/java-ignore-expired-ssl-sertificate) – Anya Shenanigans Apr 03 '13 at 15:49

0 Answers0