使用不受信任的证书在 Android 应用程序中安全支持 HTTPS
我知道这个问题被问了好几次，但我没有找到任何完整的解决方案...上下文如下：我正在开发一个 Android 应用程序，它允许用户连接到他的自托管 Web 应用程序实例。有用户联系我，询问是否可以添加HTTPS的支持，当然还有自制证书的支持。所以我读了很多东西，这就是我的理解：
- 简单但不安全的解决方案是允许所有证书，而不检查任何内容。我实现了它并且它有效，但这显然不是一个好的解决方案！
- 另一个解决方案是创建包含所需证书的密钥库。但一方面我事先不知道用户的证书，另一方面，很难要求想要使用这个带有 HTTPS 的应用程序的用户玩 keytool 或其他东西......
所以我例如，想要实现与网络浏览器相同的解决方案。因此，当用户第一次尝试使用 HTTPS 连接到其自托管服务器时，应用程序会向他显示不受信任的证书的详细信息，并询问他是否确定要连接。通过选择“是的，我确定”，该证书将被存储，并且应用程序永远不会询问他任何相关信息。
目前，我正在使用带有 HTTPClient 和自定义 SSLSocketFactory 的解决方案，它允许所有证书... 我还看到了类似 SLSocketFactory.BROWSER_COMPATIBLE_HOSTNAME_VERIFIER 的东西，但我不太明白它是否可以帮助我。
您知道我如何提供用户友好且安全的解决方案来使用 HTTPS 和自制证书吗？
I know this question was asked several times but I didn't find any complete solution... Here is the context : I'm developping an Android application which allow the user to connect to his self-hosted instance of a web application. Some users contacted me to ask if I could add the support of HTTPS and of course, the support of home-made certificates. So I read a lot of stuff and this is what I understood :
- The easy but unsecure solution is to allow all certificates, without checking anything. I implemented that and it works but it's clearly not a good solution!
- Another solution is to create a keystore with the needed certificates. But on the one hand I don't know in advance the certificates of the users, and on the other hand, it's difficult to ask the user who want to use this application with HTTPS to play with keytool or something else...
So I would like to implement the same solution as a web browser for example. So, when a user try to connect to his self-hosted server with HTTPS for the first time, the application show him the details of the untrusted certificate and ask him if he is sure to want to connect. By selecting "Yes I'm sure", this certificate will be stored and the application will never ask him anything about that.
For now, I'm using a solution with HTTPClient and a custom SSLSocketFactory which allow all certificates...
I also saw something like SLSocketFactory.BROWSER_COMPATIBLE_HOSTNAME_VERIFIER but I don't really understand if it could help me.
Do you have any idea about how I could offer a user-friendly and secure solution to use HTTPS with home-made certificates?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论