HTTPS with Self-Signed SSL Certificate Issues... Solution or better way?

Question

All I need to do is download some basic text-based and image files from a web server that has a self-signed SSL certificate.

I have been trying to figure out how to use HttpClient to do this, but getting the SSL to work is a nightmare that seems to be way too much trouble for such a simple task.

Is there a better way to perform these file downloads? Perhaps through a WebView or Browser feature? Reinventing the wheel of making a simple HTTPS GET request is a major pain, and is significantly holding up my development schedule.

Answer 1

I think you could do it with the HttpsURLConnection. Try this out:

URL url = new URL("https://yourhttpsurl.com");
URLConnection conn = url.openConnection(); // should return a HttpsURLConnection

BufferedReader in = new BufferedReader(
        new InputStreamReader(conn.getInputStream()));
String str;
while ((str = in.readLine()) != null) {
    // Process str
}

in.close();

I just did the very same task, but I needed handling of cookies as well (and I was lazy) so I actually used HttpClient in the Android app. I know it's a huge overkill but I believe that most of the HttpClient code was unused (that is, unreferenced and thus not compiled) in my small app, because the resulting .apk was just a few kb large.

Edit: It just struck me I've only tested the first approach with properly signed centificates.

Answer 2

I would recommend getting a non-self-signed cert for the server.

That being said, here is an example of creating an SSLSocketFactory that supports self-signed certs, and here is an example of using an SSLSocketFactory with HttpClient.

Answer 3

I found two great examples of how to accept self-signed SSL certificates, one each for HttpsURLConnection and HttpClient.

HttpsURLConnection solution: http://stackoverflow.com/questions/995514/https-connection-android

HttpClient solution: http://stackoverflow.com/questions/1217141/self-signed-ssl-acceptance-android