One solution for Android TLS/SSL client authentication

Some time ago our customer has decided to implement a more secure way of transmitting form data from an Android app to a webservice. Previously we used a simple HTTPS connection to send form data via webservice. In updated version customer wanted to use TLS/SSL to authenticate server and clients. The basic operations in TLS/SSL connection are: validation of the identity of the HTTPS server against a list of trusted certificates and client authentication to the HTTPS server using a private key.

We got a client certificate in form of *.p12 file to authenticate to the HTTPS server using a private key. The identity of the HTTPS server was not validated, we trusted to all servers. *.p12 file format is commonly used to store X.509 private keys with accompanying public key certificates, protected with a password-based symmetric key.

In Android development SSLSocketFactory is used to validate the identity of the HTTPS server and to authenticate client to the HTTPS server using a private key. SSLSocketFactory will enable server authentication when supplied with a truststore file containg one or several trusted certificates but in our case we trust to all servers. SSLSocketFactory will enable client authentication when supplied with a keystore file containg a private key/public certificate pair. The client secure socket will use the private key to authenticate itself to the target HTTPS server during the SSL session handshake if requested to do so by the server. The target HTTPS server will in its turn verify the certificate presented by the client in order to establish client’s authenticity. Therefore, the solution for our problem was to create custom SSLSocketFactory . The custom SSLSocketFactory was then used to construct HttpClient that executes HTTP(S) requests.

Custom SSLSocketFactory class:

After that we can easily execute HTTP(S) post: