Android app client Mutual TLS with java server

Question

I'm trying to send https requests to my server using mutual TLS. The server I got working successfully with TLS. But I can't figure out how to do this on the client-side (Android app). I use spring on the java server. Requests from android app are made using HttpsUrlConnection(). I managed to be able to call HttpsUrlConnection() this how my

Accepted Answer

What you are looking for is mutual authentication based on certificates. Both the server and the client needs to trust each other to communicate. And if the server just trust that specific client only it shouldn&#8217;t be possible for any other client to do a request.The above example looks okay, but it will be easier to configure with the example below:import static java.util.Objects.isNull;import static org.apache.commons.lang3.StringUtils.isBlank;import java.io.IOException;import java.io.InputStream;import java.security.KeyManagementException;import java.security.KeyStore;import java.security.KeyStoreException;import java.security.NoSuchAlgorithmException;import java.security.UnrecoverableKeyException;import java.security.cert.CertificateException;import javax.net.ssl.KeyManager;import javax.net.ssl.KeyManagerFactory;import javax.net.ssl.SSLContext;import javax.net.ssl.TrustManager;import javax.net.ssl.TrustManagerFactory;public class SSLTrustManagerHelper {    private String keyStore;    private String keyStorePassword;    private String trustStore;    private String trustStorePassword;    public SSLTrustManagerHelper(String keyStore,                                 String keyStorePassword,                                 String trustStore,                                 String trustStorePassword) {        if (isBlank(keyStore) || isBlank(keyStorePassword) || isBlank(trustStore) || isBlank(trustStorePassword)) {            throw new ClientException("TrustStore or KeyStore details are empty, which are required to be present when SSL is enabled");        }        this.keyStore = keyStore;        this.keyStorePassword = keyStorePassword;        this.trustStore = trustStore;        this.trustStorePassword = trustStorePassword;    }    public SSLContext clientSSLContext() {        try {            TrustManagerFactory trustManagerFactory = getTrustManagerFactory(trustStore, trustStorePassword);            KeyManagerFactory keyManagerFactory = getKeyManagerFactory(keyStore, keyStorePassword);            return getSSLContext(keyManagerFactory.getKeyManagers(), trustManagerFactory.getTrustManagers());        } catch (UnrecoverableKeyException | NoSuchAlgorithmException | CertificateException | KeyStoreException | IOException | KeyManagementException e) {            throw new ClientException(e);        }    }    private static SSLContext getSSLContext(KeyManager[] keyManagers, TrustManager[] trustManagers) throws NoSuchAlgorithmException, KeyManagementException {        SSLContext sslContext = SSLContext.getInstance("TLSv1.2");        sslContext.init(keyManagers, trustManagers, null);        return sslContext;    }    private static KeyManagerFactory getKeyManagerFactory(String keystorePath, String keystorePassword) throws NoSuchAlgorithmException, KeyStoreException, IOException, CertificateException, UnrecoverableKeyException {        KeyStore keyStore = loadKeyStore(keystorePath, keystorePassword);        KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());        keyManagerFactory.init(keyStore, keystorePassword.toCharArray());        return keyManagerFactory;    }    private static TrustManagerFactory getTrustManagerFactory(String truststorePath, String truststorePassword) throws KeyStoreException, IOException, NoSuchAlgorithmException, CertificateException {        KeyStore trustStore = loadKeyStore(truststorePath, truststorePassword);        TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());        trustManagerFactory.init(trustStore);        return trustManagerFactory;    }    private static KeyStore loadKeyStore(String keystorePath, String keystorePassword) throws KeyStoreException, IOException, NoSuchAlgorithmException, CertificateException {        try(InputStream keystoreInputStream = SSLTrustManagerHelper.class.getClassLoader().getResourceAsStream(keystorePath)) {            if (isNull(keystoreInputStream)) {                throw new ClientException(String.format("Could not find the keystore file with the given location %s", keystorePath));            }            KeyStore keystore = KeyStore.getInstance(KeyStore.getDefaultType());            keystore.load(keystoreInputStream, keystorePassword.toCharArray());            return keystore;        }    }}Here you need to provide the location of the keystore and truststore, and also the passwords. The public class will provide you the ssl context which you can load into your http client.Make sure you have a client keystore with private and public key, and a truststore where you have the public key of the server. And make sure that the server has the public key of the client in its truststore. You also need to provide your server an additional properties in the application.yml file which enforces the server to validate the client. The property is: client-auth: needSee here a full example of setting up mutual authentication for server and client including example project spring-boot-mutual-tls-sllUpdate 2022I have made the above snippet and other utilities available in a library to make it easier and less verbose to setup ssl configuration. Next to that it also contains some validations. See here for the library GitHub &#8211; SSLContext KickstartThe example which I provided at the first place can be replaced with:import javax.net.ssl.SSLContext;import javax.net.ssl.SSLSocketFactory;class App {    public static void main(String[] args) {        SSLFactory sslFactory = SSLFactory.builder()                .withIdentityMaterial("/path/to/resource/identity.jks", "password".toCharArray())                .withTrustMaterial("/path/to/resource/truststore.jks", "password".toCharArray())                .build();        SSLContext sslContext = sslFactory.getSslContext();        SSLSocketFactory sslSocketFactory = sslFactory.getSslSocketFactory();    }}

Advertisement

Answer

Update 2022