Android app rejected google play because of Vulnerability issue

Question

After uploading app to play market getting this note: "To properly handle SSL certificate validation, change your code in the checkServerTrusted method of your custom X509TrustManager interface to raise either CertificateException or IllegalArgumentException whenever the certificate presented by the server does not meet your expectations." How could be that done, please help.

my code is:enter image description here

Possible duplicate of [How to fix unsafe implementation of X509TrustManager in Android app](http://stackoverflow.com/questions/35530558/how-to-fix-unsafe-implementation-of-x509trustmanager-in-android-app) — user3673952, Jun 16 '16 at 19:34

score 0 · Answer 1 · answered Jun 16 '16 at 19:51

0

Use Switch to simple moode then refresh the page and try again to upload APK. In google play developer console

answered Jun 16 '16 at 19:51

Rifan

424
6
17

score 0 · Answer 2 · answered Apr 21 '17 at 13:17

I also had SSLCertification issue at the time uploading singed apk.
you have to return true for all your trusted http hosts including 3rd party libraries http.

Here i am putting how i solved that issue, sorry for security i didn't put original path of links, these Link Helps me

        TrustManager[] trustAllCerts = new TrustManager[]{new X509TrustManager() {
            public X509Certificate[] getAcceptedIssuers() {
                X509Certificate[] myTrustedAnchors = new X509Certificate[0];
                return myTrustedAnchors;
            }

            @Override
            public void checkClientTrusted(X509Certificate[] certs, String authType) {
            }

            @Override
            public void checkServerTrusted(X509Certificate[] certs, String authType) {
            }
        }};


    SSLContext sc = SSLContext.getInstance("SSL");
    sc.init(null, trustAllCerts, new SecureRandom());
    HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
    HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier() {
        @Override
        public boolean verify(String hostname, SSLSession arg1) {
            if (hostname.equalsIgnoreCase("demo.mysite.com") ||
                    hostname.equalsIgnoreCase("prod.mysite.com") ||
                    hostname.equalsIgnoreCase("22.2.202.22:3333") ||
                    hostname.equalsIgnoreCase("cloud.cloudDeveSite.net") ||                            
                    hostname.equalsIgnoreCase("11.2.222.22:2222") ||
                    hostname.equalsIgnoreCase("multispidr.3rdPartyLibrary.io")) {
                return true;
            } else {
                return false;
            }
        }
    });

Mentioned all api's which having SSLCertification issue, you also have to mention 3rd party api's too, you will get those HTTP links in error at the time when you run that code.

Android app rejected google play because of Vulnerability issue

2 Answers2