How to make https request with ssl certificate in Retrofit

Question

I have a .p12 certificate file, and I use the SSL Converter to convert it to a .pem certificate file. Then I use that pem certificate file in my android code like this:

OkHttpClient okHttpClient = new OkHttpClient();
        try {
            CertificateFactory cf = CertificateFactory.getInstance("X.509");
            InputStream instream = context.getResources().openRawResource(R.raw.pem_certificate);
            Certificate ca;
            ca = cf.generateCertificate(instream);
            KeyStore kStore = KeyStore.getInstance(KeyStore.getDefaultType());
            kStore.load(null, null);
            kStore.setCertificateEntry("ca", ca);
            TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
            tmf.init(kStore);
            SSLContext sslContext = SSLContext.getInstance("TLS");
            sslContext.init(null, tmf.getTrustManagers(), null);
            okHttpClient.setSslSocketFactory(sslContext.getSocketFactory());
        } catch (CertificateException
                | KeyStoreException
                | NoSuchAlgorithmException
                | IOException
                | KeyManagementException e) {
            e.printStackTrace();
        }

        baseURL = endpoint;
        RestAdapter restAdapter = new RestAdapter.Builder()
                .setEndpoint(baseURL)
                .setClient(new OkClient(okHttpClient))
                .build();

        service = restAdapter.create(DishService.class);

But this code doesn't work. It was failed at the line "ca = cf.generateCertificate(instream);" with CertificateException message.

Answer 1

Maybe you have a problem in R.raw.pem_certificate...

1) Try to get a raw public certificate from server using openssl : openssl s_client -connect {HOSTNAME}:{PORT} -showcerts

(please look here for details: https://superuser.com/questions/97201/how-to-save-a-remote-server-ssl-certificate-locally-as-a-file)

2) How to setup Retrofit2 with a custom SSL sertificate https://adiyatmubarak.wordpress.com/tag/add-ssl-certificate-in-retrofit-2/

or Retrofit1: https://number1.co.za/use-retrofit-self-signed-unknown-ssl-certificate-android/

PS: it works for me, please don't convert PEM file to BKS.

Answer 2

public class RetrofitBuilder {

private static Retrofit retrofit = null;
private static final String BASE_URL = BuildConfig.BASE_URL;
private static final String API_VERSION = BuildConfig.VERSION;

private static OkHttpClient.Builder httpClientBuilder = null;

public static Retrofit getInstance(Context context) {
    if (retrofit == null) {

        httpClientBuilder = new OkHttpClient.Builder().readTimeout(5, TimeUnit.SECONDS);
        initHttpLogging();
        initSSL(context);

        Retrofit.Builder builder = new Retrofit.Builder()
                .baseUrl(BASE_URL + API_VERSION)
                .addConverterFactory(GsonConverterFactory.create())
                .client(httpClientBuilder.build());


        retrofit = builder.build();

    }
    return retrofit;
}


private static void initHttpLogging() {
    HttpLoggingInterceptor logging = new HttpLoggingInterceptor();
    logging.setLevel(HttpLoggingInterceptor.Level.BODY);
    if (BuildConfig.DEBUG) httpClientBuilder.addInterceptor(logging);
}

private static void initSSL(Context context) {

    SSLContext sslContext = null;
    try {
        sslContext = createCertificate(context.getResources().openRawResource(R.raw.cert));
    } catch (CertificateException | IOException | KeyStoreException | KeyManagementException | NoSuchAlgorithmException e) {
        e.printStackTrace();
    }

    if(sslContext!=null){
        httpClientBuilder.sslSocketFactory(sslContext.getSocketFactory(), systemDefaultTrustManager());
    }

}

private static SSLContext createCertificate(InputStream trustedCertificateIS) throws CertificateException, IOException, KeyStoreException, KeyManagementException, NoSuchAlgorithmException{

    CertificateFactory cf = CertificateFactory.getInstance("X.509");
    Certificate ca;
    try {
        ca = cf.generateCertificate(trustedCertificateIS);
    } finally {
        trustedCertificateIS.close();
    }

    // creating a KeyStore containing our trusted CAs
    String keyStoreType = KeyStore.getDefaultType();
    KeyStore keyStore = KeyStore.getInstance(keyStoreType);
    keyStore.load(null, null);
    keyStore.setCertificateEntry("ca", ca);

    // creating a TrustManager that trusts the CAs in our KeyStore
    String tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
    TrustManagerFactory tmf = TrustManagerFactory.getInstance(tmfAlgorithm);
    tmf.init(keyStore);

    // creating an SSLSocketFactory that uses our TrustManager
    SSLContext sslContext = SSLContext.getInstance("TLS");
    sslContext.init(null, tmf.getTrustManagers(), null);
    return sslContext;

}

private static X509TrustManager systemDefaultTrustManager() {

    try {
        TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        trustManagerFactory.init((KeyStore) null);
        TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
        if (trustManagers.length != 1 || !(trustManagers[0] instanceof X509TrustManager)) {
            throw new IllegalStateException("Unexpected default trust managers:" + Arrays.toString(trustManagers));
        }
        return (X509TrustManager) trustManagers[0];
    } catch (GeneralSecurityException e) {
        throw new AssertionError(); // The system has no TLS. Just give up.
    }

}

}

After reading lots of post, blogs and gist I finally found a way. This works for me.

Answer 3

The answer from Jay got me started, but I got this error: Trust anchor for certification path not found

I managed to import the p12 certificate I had into a keystore using the KeyTool command.

More specifically:

Step 1. Generate a new keystore with a default certificate and then delete it

keytool -genkey -alias mycert -keyalg RSA -keysize 2048 -keystore mykeystore
keytool -delete -alias mycert -keystore mykeystore
keytool -v -list -keystore mykeystore

Step 2. Import the certificate

keytool -v -importkeystore -srckeystore <path to certificate> -srcstoretype PKCS12 -destkeystore mykeystore -deststoretype PKCS12
keytool -v -list -keystore mykeystore

Step 3: I then used the following code to load the SSLContext:

    // open the keystore
    KeyStore keyStore = KeyStore.getInstance(type);
    try {
        keyStore.load(keystoreInputStream, password.toCharArray());
    } finally {
        try {
            keystoreInputStream.close();
        } catch (IOException e) {
            // swallow this
        }
    }

    // create and initialise a key manager factory
    KeyManagerFactory kmf = KeyManagerFactory.getInstance("X509");
    if (password != null && !password.trim().equals("")) {
        kmf.init(keyStore, password.toCharArray());
    } else {
        kmf.init(keyStore, null);
    }

    // build an SSL context
    KeyManager[] keyManagers = kmf.getKeyManagers();
    SSLContext sslContext = SSLContext.getInstance("TLS");
    sslContext.init(keyManagers, null, null);

Thanks to the code here: https://chariotsolutions.com/blog/post/https-with-client-certificates-on/

Answer 4

Step1: Put your security certificate inside raw directory like src/main/res/raw/client_certificate.cer

Step2: Create a SSLContext object with this certificate like

SSLContext sslContext = createCertificate(getApplicationContext().getResources().openRawResource(R.raw.client_certificate));

Step3: Add the created SSLContext object to your OkHttpClient builder.

addClientCertificate(okHttpClientBuilder);

Step4: Set the OkHttpClient builder to retrofit client like.

retrofitBuilder.client(okHttpClientBuilder.build());

Here is complete implementation for all above mentioned steps in RetrofitManager.java file.

RetrofitManager.java

import com.google.gson.Gson;
import com.google.gson.GsonBuilder;

import java.io.IOException;
import java.io.InputStream;
import java.security.GeneralSecurityException;
import java.security.KeyManagementException;
import java.security.KeyStore;
import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;
import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import java.util.concurrent.TimeUnit;

import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManager;
import javax.net.ssl.TrustManagerFactory;
import javax.net.ssl.X509TrustManager;
import java.security.cert.Certificate;
import okhttp3.OkHttpClient;
import okhttp3.Request;
import okhttp3.logging.HttpLoggingInterceptor;
import retrofit2.Retrofit;
import retrofit2.adapter.rxjava.RxJavaCallAdapterFactory;
import retrofit2.converter.gson.GsonConverterFactory;

/**
 * Created by Rajoo Kannaujiya on 02/16/2020.
 */

public class RetrofitManager {
    private static final String URL = "https://stackoverflow.com"; // Fetch url from config file.
    private static final String TLS = "TLS";
    private static final String SSL = "SSL";
    private static final String CA = "ca";
    private static final String X_509 = "X.509";
    private static final String PROD = "prod";
    private static X509TrustManager trustManager = null;
    private static final String CONTENT_TYPE = "Content-Type";
    private static final String CONTENT_TYPE_VALUE = "application/json";
    public static final String BUILD_TYPE = "prod"; // Fetch build type from config file (Whether it is a dev, qa, stage or prod build).

    public static Retrofit getRetrofitForAPIUrl() {
        return getRetrofit(URL);
    }

    private static Retrofit getRetrofit(String url) {
        Gson gson = new GsonBuilder().setLenient().create();

        Retrofit.Builder retrofitBuilder = new Retrofit.Builder()
                .addCallAdapterFactory(RxJavaCallAdapterFactory.create())
                .addConverterFactory(GsonConverterFactory.create(gson))
                .baseUrl(url);

        HttpLoggingInterceptor logging = new HttpLoggingInterceptor();
        logging.level(HttpLoggingInterceptor.Level.BODY);

        OkHttpClient.Builder okHttpClientBuilder = new OkHttpClient.Builder();
        okHttpClientBuilder.addInterceptor(chain -> {
            Request origReq = chain.request();
            Request.Builder requestBuilder = origReq.newBuilder()
                    .addHeader(CONTENT_TYPE, CONTENT_TYPE_VALUE);

            Request request = requestBuilder.build();
            return chain.proceed(request);
        });

        addClientCertificate(okHttpClientBuilder);

        OkHttpClient.Builder okHttpBuilder = okHttpClientBuilder
                .connectTimeout(10, TimeUnit.SECONDS)
                .writeTimeout(20, TimeUnit.SECONDS)
                .readTimeout(30, TimeUnit.SECONDS)
                .addInterceptor(logging);
        retrofitBuilder.client(okHttpBuilder.build());

        return retrofitBuilder.build();
    }

    /**
     * Method to create SSLContext object for the client certificate and return it.
     *
     * @param clientCertificate
     * @return SSLContext Object
     */
    private static SSLContext getSSLContextForClientCertificate(InputStream clientCertificate) {
        SSLContext sslContext = null;
        // If given client certificate is for production environment only, Then check put check for build type.
        if (PROD.contentEquals(BUILD_TYPE)) {
            // Creating X.509 certificate factory instance
            CertificateFactory cf = null;
            try {
                cf = CertificateFactory.getInstance(X_509);
            } catch (CertificateException e) {
                e.printStackTrace();
            }
            // Generating client certificate
            Certificate ca = null;
            try {
                try {
                    if (cf != null) {
                        ca = cf.generateCertificate(clientCertificate);
                    }
                } catch (CertificateException e) {
                    e.printStackTrace();
                }
            } finally {
                try {
                    clientCertificate.close();
                } catch (IOException e) {
                    e.printStackTrace();
                }
            }
            // Creating a KeyStore containing our trusted CAs
            String keyStoreType = KeyStore.getDefaultType();
            KeyStore keyStore = null;
            try {
                keyStore = KeyStore.getInstance(keyStoreType);
            } catch (KeyStoreException e) {
                e.printStackTrace();
            }
            if (keyStore != null) {
                try {
                    keyStore.load(null, null);
                } catch (CertificateException | IOException | NoSuchAlgorithmException e) {
                    e.printStackTrace();
                }
                try {
                    keyStore.setCertificateEntry(CA, ca);
                } catch (KeyStoreException e) {
                    e.printStackTrace();
                }
            }
            // Creating a TrustManager that trusts the CAs in our KeyStore
            String tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
            TrustManagerFactory tmf = null;
            try {
                tmf = TrustManagerFactory.getInstance(tmfAlgorithm);
            } catch (NoSuchAlgorithmException e) {
                e.printStackTrace();
            }
            try {
                if (tmf != null) {
                    tmf.init(keyStore);
                }
            } catch (KeyStoreException e) {
                e.printStackTrace();
            }
            // Creating an SSLContext instance that uses our TrustManager
            try {
                sslContext = SSLContext.getInstance(TLS);
            } catch (NoSuchAlgorithmException e) {
                e.printStackTrace();
            }
            try {
                if (sslContext != null && tmf != null) {
                    sslContext.init(null, tmf.getTrustManagers(), null);
                }
            } catch (KeyManagementException e) {
                e.printStackTrace();
            }
        } else { // For non prod environment build. This section is useful only if you don't have client certificate for lower environment.
            try {
                sslContext = SSLContext.getInstance(SSL);
                sslContext.init(null, new TrustManager[]{getTrustManager()}, new java.security.SecureRandom());
            } catch (NoSuchAlgorithmException | KeyManagementException e) {
                e.printStackTrace();
            }
        }
        trustManager = getTrustManager();
        return sslContext;
    }

    /**
     * Method to add client certificate to OkHttpClient.Builder object.
     *
     * @param okHttpClientBuilder
     * @return void
     */
    private static void addClientCertificate(OkHttpClient.Builder okHttpClientBuilder) {
        SSLContext sslContext = getSSLContextForClientCertificate(getApplicationContext().getResources().openRawResource(R.raw.myaccount_coxbusiness_com));
        if (sslContext != null) {
            okHttpClientBuilder.sslSocketFactory(sslContext.getSocketFactory(), trustManager);
            okHttpClientBuilder.hostnameVerifier((hostname, session) -> true);
        }
    }

    private static X509TrustManager getTrustManager() {
        X509TrustManager trustManager = null;
        if (PROD.contentEquals(BUILD_TYPE)) { // If client certificate is only available for prod environment.
            try {
                TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
                trustManagerFactory.init((KeyStore) null);
                TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
                if (trustManagers[0] instanceof X509TrustManager) {
                    trustManager = (X509TrustManager) trustManagers[0];
                }
            } catch (GeneralSecurityException e) {
                throw new AssertionError();
            }
        } else { // For non prod environment build. This section is useful only if you don't have client certificate for lower environment.
            trustManager = new X509TrustManager() {
                @Override
                public void checkClientTrusted(X509Certificate[] x509Certificates, String s) throws CertificateException {

                }

                @Override
                public void checkServerTrusted(X509Certificate[] x509Certificates, String s) throws CertificateException {

                }

                @Override
                public X509Certificate[] getAcceptedIssuers() {
                    return new X509Certificate[0];
                }
            };
        }
        return trustManager;
    }
}

Answer 5

Following @Jay's answer, here is the kotlin version :

    private var retrofit: Retrofit? = null
    private val BASE_URL: String = BuildConfig.BASE_URL
    private val API_VERSION: String = BuildConfig.VERSION
    private var httpClientBuilder: Builder? = null
    fun getInstance(context: Context): Retrofit? {
        if (retrofit == null) {
            httpClientBuilder = Builder().readTimeout(5, TimeUnit.SECONDS)
            initHttpLogging()
            initSSL(context)
            val builder = Retrofit.Builder()
                .baseUrl(BASE_URL + API_VERSION)
                .addConverterFactory(GsonConverterFactory.create())
                .client(httpClientBuilder.build())
            retrofit = builder.build()
        }
        return retrofit
    }

    private fun initHttpLogging() {
        val logging = HttpLoggingInterceptor()
        logging.setLevel(HttpLoggingInterceptor.Level.BODY)
        if (BuildConfig.DEBUG) httpClientBuilder.addInterceptor(logging)
    }

    private fun initSSL(context: Context) {
        var sslContext: SSLContext? = null
        try {
            sslContext = createCertificate(context.resources.openRawResource(R.raw.cert))
        } catch (e: CertificateException) {
            e.printStackTrace()
        } catch (e: IOException) {
            e.printStackTrace()
        } catch (e: KeyStoreException) {
            e.printStackTrace()
        } catch (e: KeyManagementException) {
            e.printStackTrace()
        } catch (e: NoSuchAlgorithmException) {
            e.printStackTrace()
        }
        if (sslContext != null) {
            httpClientBuilder.sslSocketFactory(
                sslContext.socketFactory,
                systemDefaultTrustManager()
            )
        }
    }

    @Throws(
        CertificateException::class,
        IOException::class,
        KeyStoreException::class,
        KeyManagementException::class,
        NoSuchAlgorithmException::class
    )
    private fun createCertificate(trustedCertificateIS: InputStream): SSLContext {
        val cf = CertificateFactory.getInstance("X.509")
        val ca: Certificate
        ca = try {
            cf.generateCertificate(trustedCertificateIS)
        } finally {
            trustedCertificateIS.close()
        }

        // creating a KeyStore containing our trusted CAs
        val keyStoreType = KeyStore.getDefaultType()
        val keyStore = KeyStore.getInstance(keyStoreType)
        keyStore.load(null, null)
        keyStore.setCertificateEntry("ca", ca)

        // creating a TrustManager that trusts the CAs in our KeyStore
        val tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm()
        val tmf = TrustManagerFactory.getInstance(tmfAlgorithm)
        tmf.init(keyStore)

        // creating an SSLSocketFactory that uses our TrustManager
        val sslContext = SSLContext.getInstance("TLS")
        sslContext.init(null, tmf.trustManagers, null)
        return sslContext
    }

    private fun systemDefaultTrustManager(): X509TrustManager {
        return try {
            val trustManagerFactory =
                TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm())
            trustManagerFactory.init(null as KeyStore?)
            val trustManagers = trustManagerFactory.trustManagers
            check(!(trustManagers.size != 1 || trustManagers[0] !is X509TrustManager)) {
                "Unexpected default trust managers:" + Arrays.toString(
                    trustManagers
                )
            }
            trustManagers[0] as X509TrustManager
        } catch (e: GeneralSecurityException) {
            throw AssertionError() // The system has no TLS. Just give up.
        }
    }