How to accept incoming self-signed SSL certificate in OkHttp? - okhttp

Question

I have this requirement, where the app is dustributed, so endpoints are per company, nothing centralized. The issue is the app needs to allow for self-signed certificates.
Obviously I cannot just hardcode the certificate in the app and use the milions of the snippets available to do this.
So, is there a way upon such SSL exception that the cert is untrusted, then to show the user "This certificate is not trusted bla bla. Accept?".
TLDR; how to get offending certificate contents in OkHttp, so it then can be saved in sslSocketFactory subclass?

Answer 1

You can adapt something like the following example code
private fun createInsecureTrustManager(): X509TrustManager = object : X509TrustManager {
override fun checkClientTrusted(chain: Array<X509Certificate>, authType: String) {}
override fun checkServerTrusted(chain: Array<X509Certificate>, authType: String) {
val s = "Do you want to accept {${chain.first().subjectX500Principal.name}}?"
val response = JOptionPane.showConfirmDialog(null, s, "Confirm",
JOptionPane.YES_NO_OPTION, JOptionPane.QUESTION_MESSAGE)
if (response == JOptionPane.NO_OPTION) {
throw CertificateException("Not accepting ${chain.first().subjectX500Principal.name}}")
}
}
override fun getAcceptedIssuers(): Array<X509Certificate> = arrayOf()
}
Adding it to the keystore shouldn't need to be the goal, you should just be able to accept it before the keystore verification is run. n.b. This example should probably fall back to the default logic, but it should get you started.