CODEWITHSUNDEEP
androidsecuritysslhttpswebview
surlac
surlac

Reputation: 2961

WebView: loading a page over SSL (1024 bits key size)

I'm trying to load a page with WebView over HTTPS.
The host has RSA X.509 certificate with 1024 bits key size.
The error message: "errorCode=-2; description=Couldn't find the URL." (appears in 20 seconds after request).
How would I load the page in this case?
I believe the problem is that WebView doesn't like certificate with short (<=1024 bits) key size.

1) Tried:
1.1) put handler.proceed() to onReceivedSslError(): method not called;
1.2) replace android.net.http.SslError in my project: no effect;
1.3) to force WebView to use provided KeyStore (source): doesn't work with API >=18;
1.4) load HTML data with DefaultHttpClient (bypassing HTTPS) and display it with WebView.loadDataWithBaseURL(): works, but static data not loaded (need to parse HTML and load img/js separately).

2) Notes:
2.1) there is no way to replace certificate on server;
2.2) if I use a host with certificate which has 2048 bits key size the SSL can be bypassed by method 1.1);
2.3) the certificate is self-signed (but it doesn't make a difference);
Device: Samsung Galaxy S3 with API 18 (4.3).

[EDIT]
I've saved cert as DER, renamed to CER (cert.cer), put it at the root of internal storage, "Install from internal storage", enter pin, "credential use: VPN and apps", and it says "cert successfully installed".
I've tried to run WebView again, output on:
1. Motorola Moto G "errorCode=-8; description=The connection to the server timed out." (in 30 seconds);
2. Samsung Galaxy S3 "onReceivedError: errorCode=-6; description=Couldn't connect to the server." (in 30 seconds also).

[EDIT]
To reproduce:
1. generate keypair (private key and X.509 cert with RSA 1024 bits key);
2. add to keystore;
3. deploy to application server (Tomcat);
4. specify connector for HTTPs;
5. try to access web-page from WebView.

Upvotes: 2

Views: 871

Answers (1)

user207421
user207421

Reputation: 310980

errorCode=-2; description=Couldn't find the URL." (appears in 20 seconds after request).

If that's the result of an HTTP status 404 it indicates (1) that the SSL part is working perfectly and (2) that the requested resource didn't exist. It might also indicate a connect timeout or read timeout. If it was an SSL/HTTPS problem I would expect a more specific message.

Upvotes: 1

Related Questions