Self signed SSL certificate on Android Client

fabiomax

Hello, we are having the same issue as the one described here: https://forums.lightstreamer.com/showthread.php?4270-using-a-Self-Signed-SSL-on-Android-Client.
We have tried the solution suggested in the aforementioned post but it doesn't seem to work in my case:

CertificateFactory cf = null;
        try {
            cf = CertificateFactory.getInstance("X.509");
            InputStream caInput =  _c.getAssets().open("certificate.cer");
            Certificate ca;
            try{
                ca = cf.generateCertificate(caInput);
            }finally{
                caInput.close();
            }

// Create a KeyStore containing our trusted CAs
            String keyStoreType = KeyStore.getDefaultType();
            KeyStore keyStore =KeyStore.getInstance(keyStoreType);
            keyStore.load(null,null);
            keyStore.setCertificateEntry("ca", ca);

// Create a TrustManager that trusts the CAs in our KeyStore
            String tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
            TrustManagerFactory tmf =TrustManagerFactory.getInstance(tmfAlgorithm);
            tmf.init(keyStore);
            // Create an SSLContext that uses our TrustManager
            SSLContext context =SSLContext.getInstance("TLS");
            context.init(null, tmf.getTrustManagers(),null);
            HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier() {
                @Override
                public boolean verify(String hostname, SSLSession session) {
                    return true;
                }
            });
            HttpsURLConnection.setDefaultSSLSocketFactory(context.getSocketFactory());

Delving into the client's machinery it seems that it ultimately relies on NettyHttp* classes, but there seems to be no way for us to access/configure SSL policies on that layer. Do you have any suggestions?

Thanks

Alessandro.Carioni

Hi,

We are investigating the issue. We'll answer as soon as possible.

Regards

Alessandro.Carioni

We have decided to extend the client interface to support this use case.
The patch will be available in the next few days.
Which client version are you using?

fabiomax

Hello, thanks! We're currently using the 3.1.6

Alessandro.Carioni

We have released the version 3.1.7 of Android client.
The new library contains the static method LightstreamerClient.setTrustManagerFactory, which can be used to set a global trust manager factory for the library. The method can be called only once before creating any instance of LightstreamerClient.

You can use the extension in this way, for example:

/* load the certificate in the trust manager */
KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
InputStream ksIn = getClass().getResourceAsStream("/my-host.keystore");
try {
keyStore.load(ksIn, "my-password".toCharArray());
} finally {
ksIn.close();
}
TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
tmf.init(keyStore);

/* install the factory */
LightstreamerClient.setTrustManagerFactory(tmf);

/* create client */
LightstreamerClient client = new LightstreamerClient("https://my-host:8443", "TEST");