SSL with Android 2.2 and 2.3

Question

If I hit a https url in Android 2.3, does it automatically use SSL? I'm having trouble with an application I've written between Android 2.2 and Android 2.3. When I hit the https url on Android 2.2, it bombs out and gives me the below, but when I use the same code on Android 2.3, I get nothing. So from the reading I've done around what I'm thinking is the type of certificate at this url is a type accepted by Android 2.3 by default, but not by Android 2.2, is that right?

05-10 13:04:37.659: WARN/System.err(2177): javax.net.ssl.SSLException: Not trusted server certificate
05-10 13:04:37.659: WARN/System.err(2177): at org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:371)
05-10 13:04:37.659: WARN/System.err(2177): at org.apache.http.conn.ssl.AbstractVerifier.verify(AbstractVerifier.java:92)
05-10 13:04:37.659: WARN/System.err(2177): at org.apache.http.conn.ssl.SSLSocketFactory.createSocket(SSLSocketFactory.java:381)
05-10 13:04:37.659: WARN/System.err(2177): at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:164)
05-10 13:04:37.659: WARN/System.err(2177): at org.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:164)
05-10 13:04:37.659: WARN/System.err(2177): at org.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:119)
05-10 13:04:37.659: WARN/System.err(2177): at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:348)
05-10 13:04:37.659: WARN/System.err(2177): at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:555)
05-10 13:04:37.659: WARN/System.err(2177): at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:487)
05-10 13:04:37.659: WARN/System.err(2177): at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:465)
05-10 13:04:37.667: WARN/System.err(2177): at giat.hermes.network.IntelinkConnector.connect(IntelinkConnector.java:120)
05-10 13:04:37.667: WARN/System.err(2177): at giat.hermes.view.CreateAccount$ThreadLogMeIn.run(CreateAccount.java:77)
05-10 13:04:37.667: WARN/System.err(2177): Caused by: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: TrustAnchor for CertPath not found.
05-10 13:04:37.667: WARN/System.err(2177): at org.apache.harmony.xnet.provider.jsse.TrustManagerImpl.checkServerTrusted(TrustManagerImpl.java:168)
05-10 13:04:37.674: WARN/System.err(2177): at org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:366)
05-10 13:04:37.674: WARN/System.err(2177): ... 11 more
05-10 13:04:37.674: WARN/System.err(2177): Caused by: java.security.cert.CertPathValidatorException: TrustAnchor for CertPath not found.
05-10 13:04:37.698: WARN/System.err(2177): at org.bouncycastle.jce.provider.PKIXCertPathValidatorSpi.engineValidate(PKIXCertPathValidatorSpi.java:225)
05-10 13:04:37.698: WARN/System.err(2177): at java.security.cert.CertPathValidator.validate(CertPathValidator.java:202)
05-10 13:04:37.698: WARN/System.err(2177): at org.apache.harmony.xnet.provider.jsse.TrustManagerImpl.checkServerTrusted(TrustManagerImpl.java:164)
05-10 13:04:37.698: WARN/System.err(2177): ... 12 more

And I don't want to just accept all server certs

Also, if this is what's causing the problem, would it be enough to cover backwards compatibility? I'm not likely to run into this with future updates of Android right?

Answer 1

If you want/need your app to to work with 2.2 and lower, you need to include the CA certificate in your app and set up HttpClient to trust it. You don't need to (and shouldn't) accept all certificates. As for future updates, the certificate could be removed if it is compromised, but otherwise it's unlikely.

And yes, if you are accessing an HTTPS URL, data will be sent and received using SSL (encrypted). You can capture packets to verify.