HTTPs with certificates

Anything libgdx related goes here!

HTTPs with certificates

Postby Androphin » Tue Nov 13, 2018 8:45 am

Hello,

as far as I know, Gdx.net (https://libgdx.badlogicgames.com/ci/nig ... frame.html) can also fire HTTPs requests by setting the URL scheme to https.
In my case, for registration and login purposes, I need to make sure the client (Android app) is talking to the correct server and the server only allow rightful clients to connect.
Therefore I self-signed certificates for the TLS connection and read this guide about implementing https://www.codeproject.com/articles/826045/android-security-implementation-of-self-signed-ssl.
In our case, the certificate was self-signed. This means that the default TrustManager in our SSLContext will not trust the server’s certificate, and the SSL connection will fail. To avoid this we will set up a custom TrustManager that trusts our self-signed certificate, and provide that TrustManager to our custom SSLContext.

We load the certificate into a KeyStore, use that KeyStore to produce an array of TrustManagers, and then use those TrustManagers to create the SSLContext.

In our app, we included the server certificate file in the application resources (since it doesn’t change from user to user, and doesn’t change very often), but you could put this in an external file as well

If I got this right, I need to implement this behaviour platform specific for android and desktop by myself, because Gdx.net doesn't provide facilities for that?

Thanks in advance
Androphin
 
Posts: 34
Joined: Sun Aug 07, 2016 9:30 pm

Re: HTTPs with certificates

Postby evilentity » Tue Nov 13, 2018 5:24 pm

Or you could use proper certificate like a reasonable person, they are free these days. If not youll have to deal with TrustManager nonsense and probably not use Gdx.net
Looking for a freelancer? PM me!
evilentity
 
Posts: 4555
Joined: Wed Aug 24, 2011 11:37 am

Re: HTTPs with certificates

Postby Androphin » Wed Nov 14, 2018 9:56 am

Thank you.
So you think it's a bad idea to use self-signed ones, because if I'm using a generated one from a CA (like CAcert.org), I can use GDX.net, what is interfacing Androids network connection handling and therefore the systems already trusted built-in CAs?
Androphin
 
Posts: 34
Joined: Sun Aug 07, 2016 9:30 pm

Re: HTTPs with certificates

Postby evilentity » Wed Nov 14, 2018 10:10 am

Sounds like optimal solution.
Looking for a freelancer? PM me!
evilentity
 
Posts: 4555
Joined: Wed Aug 24, 2011 11:37 am

Re: HTTPs with certificates

Postby Androphin » Wed Nov 14, 2018 5:09 pm

Thank you very much.
Androphin
 
Posts: 34
Joined: Sun Aug 07, 2016 9:30 pm


Return to Libgdx

Who is online

Users browsing this forum: Exabot [Bot], Google [Bot], raeleus and 1 guest