Issue Type: Feature Request Feature Request
Affects Versions: 1.3.1
Assignee: Unassigned
Components: security
Created: 24/Mar/14 12:13 PM
Description:

[17:03:47] <pilhuhn> Do you have a "generic" way to deal with ssl certs and hostname validation in ag-andi ?
[17:04:03] <pilhuhn> Like a callback with a popup to accept a cert / hostname ?
[17:04:59] <passos> pilhuhn: Nope
[17:05:18] <passos> ssl is 'transparente' for pipe
[17:05:25] <pilhuhn> well, not really
[17:05:48] <passos> What do you mean?
[17:06:02] <pilhuhn> Caused by: javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
[17:06:10] <pilhuhn> at libcore.net.http.HttpsURLConnectionImpl.getResponseCode(HttpsURLConnectionImpl.java:134)
[17:06:10] <pilhuhn> at org.jboss.aerogear.android.impl.http.HttpRestProvider.getHeaderAndBody(HttpRestProvider.java:251)
[17:06:41] <passos> pilhuhn: Are you using a "fake" certification?
[17:07:48] <pilhuhn> Well, not really fake – but something a) which is not baked by an official CA and b) something where I only have an ip but no hostname
[17:08:04] <pilhuhn> the above is from a) – and when this is solved then b) will pop up
[17:08:51] <pilhuhn> 2nd can be worked around with HttpsURLConnection)conn).setHostnameVerifier(new HnV(... return true )), but this is of course hacky
[17:09:10] <passos> Yeap
[17:09:24] <passos> I need think about it.
[17:09:39] <pilhuhn> I believe that the situation where people put self-signed and other non-official-CA-certs onto servers is quite common
[17:10:18] <passos> pilhuhn: Yes, makes sense. Could you file a jira w/ this scenario

Project: AeroGear Android
Priority: Major Major
Reporter: Heiko Rupp
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira