android https之三

android https之一
android https之二
android https之三

	private static void installCert(String host, int port, String passwd,
			String sslProtocol) {
		try {
			String trustStorePath = System
					.getProperty("javax.net.ssl.trustStore");
			// File keystoreFile = new File(trustStorePath);
			// 由于android权限原因，无法读取trustStorePath="//system/etc/security/cacerts.bks"文件，此处由sdcard代替
			File keystoreFile = new File("/sdcard/cacerts.bks");
			InputStream in = new FileInputStream(keystoreFile);
			KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
			ks.load(in, passwd.toCharArray());
			in.close();

			SSLContext context = SSLContext.getInstance(sslProtocol);
			TrustManagerFactory tmf = TrustManagerFactory
					.getInstance(TrustManagerFactory.getDefaultAlgorithm());
			tmf.init(ks);

			X509TrustManager defaultTrustManager = (X509TrustManager) tmf
					.getTrustManagers()[0];
			SavingTrustManager tm = new SavingTrustManager(defaultTrustManager);
			context.init(null, new TrustManager[] { tm }, null);
			javax.net.ssl.SSLSocketFactory factory = context.getSocketFactory();
			boolean istrusted = false;
			try {
				SSLSocket socket = (SSLSocket) factory.createSocket(host, port);
				socket.setSoTimeout(50000);
				socket.startHandshake();
				socket.close();
				istrusted = true;
			} catch (SSLException e) {
				Log.i("xx", e.getMessage());
				istrusted = false;
			}
			if (!istrusted) {
				X509Certificate[] chain = tm.chain;
				if (chain == null) {
					return;
				}
				ks.setCertificateEntry(host + "_" + 0, chain[0]);
				// 如果想更改新密码，这个passwd替换成新密码即可
				ks.store(new FileOutputStream(new File("/sdcard/cacerts.bks")),
						passwd.toCharArray());
			}

		} catch (FileNotFoundException e) {
			Log.e("xx", e.getMessage());
		} catch (NoSuchAlgorithmException e) {
			Log.e("xx", e.getMessage());
		} catch (CertificateException e) {
			Log.e("xx", e.getMessage());
		} catch (IOException e) {
			Log.e("xx", e.getMessage());
		} catch (KeyStoreException e) {
			Log.e("xx", e.getMessage());
		} catch (KeyManagementException e) {
			Log.e("xx", e.getMessage());
		}
	}

	private static class SavingTrustManager implements X509TrustManager {

		private final X509TrustManager tm;
		private X509Certificate[] chain;

		SavingTrustManager(X509TrustManager tm) {
			this.tm = tm;
		}

		public X509Certificate[] getAcceptedIssuers() {
			throw new UnsupportedOperationException();
		}

		public void checkClientTrusted(X509Certificate[] chain, String authType)
				throws CertificateException {
			throw new UnsupportedOperationException();
		}

		public void checkServerTrusted(X509Certificate[] chain, String authType)
				throws CertificateException {
			this.chain = chain;
			tm.checkServerTrusted(chain, authType);
		}
	}
}

评论

3 楼 月下独酌 2012-08-29  

Rhamiss 写道

请问这是从sdcard安装ca证书的源代码么？能详述么

具体可以参考android源码里面的source/package/app/CertInstaller项目。

2 楼 月下独酌 2012-08-29  

Rhamiss 写道

请问这是从sdcard安装ca证书的源代码么？能详述么

这个是用来安装HTTPS证书的

通过httpclient请求https地址的时候、如果本地没有安装https的证书，会返回401未授权。

上面的例子的意思是，当请求的https地址的安全证书未安装的时候、先安装证书。然后再通过

httpclient进行访问。

这个和从SDCard安装ca证书的过程差不多的。

不过android从sdcard安装ca证书没这么复杂、SDK里面有现成的方法。

通过android.credentials.INSTALL这个intent就可实现安装。

1 楼 Rhamiss 2012-08-20  

请问这是从sdcard安装ca证书的源代码么？能详述么