httpsurlconnection - w3toppers.com

Java HttpsURLConnection and TLS 1.2

You will have to create an SSLContext to set the Protocoll: in Java 1.8: SSLContext sc = SSLContext.getInstance(“TLSv1.2”); // Init the SSLContext with a TrustManager[] and SecureRandom() sc.init(null, trustCerts, new java.security.SecureRandom()); in Java 1.7: SSLContext sc = SSLContext.getInstance(“TLSv1”); // Init the SSLContext with a TrustManager[] and SecureRandom() sc.init(null, trustCerts, new java.security.SecureRandom()); then you just have … Read more

How to override the cipherlist sent to the server by Android when using HttpsURLConnection?

This piece of code is a bit raw. please use with care. public class PreferredCipherSuiteSSLSocketFactory extends SSLSocketFactory { private static final String PREFERRED_CIPHER_SUITE = “TLS_RSA_WITH_AES_128_CBC_SHA”; private final SSLSocketFactory delegate; public PreferredCipherSuiteSSLSocketFactory(SSLSocketFactory delegate) { this.delegate = delegate; } @Override public String[] getDefaultCipherSuites() { return setupPreferredDefaultCipherSuites(this.delegate); } @Override public String[] getSupportedCipherSuites() { return setupPreferredSupportedCipherSuites(this.delegate); } @Override public … Read more

How to do an HTTPS POST from Android?

You can use the default CAs that are defined in the android device, which is just fine for any public web. If you have a self-signed certificate, you can either accept all certificates (risky, open to man-in-the-middle attacks) or create your own TrustManagerFactory, which is a bit out of this scope. Here’s some code to … Read more

How to disable SSLv3 in android for HttpsUrlConnection?

I found the solution for it by analyzing the data packets using wireshark. What I found is that while making a secure connection, android was falling back to SSLv3 from TLSv1 . It is a bug in android versions < 4.4 , and it can be solved by removing the SSLv3 protocol from Enabled Protocols … Read more