Minimal Java TrustStore to trust any 3rd party certificate?

Question

I am writing an Android client that must connect to an SSL server. Is there any way to set up the TrustStore so that it trusts any certificate that the SSL server sends over? Or is it really the case that I must somehow get the SSL server certificate and use some cryptic command line command to put this into a trust store file on my client?

Answer 1

First create the file TrustAllManager.java:

package my.package;

import javax.net.ssl.X509TrustManager;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;

public class TrustAllManager implements X509TrustManager {
    @Override
    public void checkClientTrusted(
        X509Certificate[] x509Certificates, 
        String s) throws CertificateException { }

    @Override
    public void checkServerTrusted(
        X509Certificate[] x509Certificates, 
        String s) throws CertificateException { }

    @Override
    public X509Certificate[] getAcceptedIssuers() {
        return new X509Certificate[0];
    }
}

And then use it in your code:

SSLContext sslContext = SSLContext.getInstance("TLS");
sslContext.init(null, new TrustManager[] { new TrustAllManager() }, null);
SSLContext.setDefault(sslContext);

You have to be aware of the implications, like someone could for example edit /etc/resolv.conf or change the settings of your router and your application would still think it is talking to a trusted server.

In my case I did it to support older Android 4 phones (like "Samsung Galaxy S3" built in 2012), which did not trust the "DigiCert Global Root G2" CA who issued certificates (in 2019) for my three app backends. Since I also used the nv-websocket-client library in my app, I had to add the following lines as well:

WebSocketFactory wsFactory = new WebSocketFactory();
wsFactory.setSSLContext(sslContext);
wsFactory.setVerifyHostname(false);

And for completeness I've also seen the following line being used too:

HttpsURLConnection.setDefaultSSLSocketFactory(sslContext.getSocketFactory());