SSL Pinning using Google Volley

Question

I am starting my question by mentioning what I have tried so far:

I do not have certificate in my app, I am using SHA256 key only, Most of the answer on internet requires physical certificate in app to load it in keystore, I don't have that.

I am getting following error:

javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.

1)TrustKit It need compile SDK 24 and up, but I have 23 and lots of Support library are in sync with SDK 23 so I can not change all of them, it may crash my app at some time.

2)CWAC-NetSecurity I have implemented this in my code without using Android N security setup, I have also followed instruction given on git page, but not able to pass sslSocketfactory to Volley from it, it has example with OkHTTP. so it is also giving above error.

I have tried this with OKHttp's CertificatePinner by it is also not working for me. Same error. I have also tried to pass hostNameVerifier and sslSocketFactory to HttpsUrlConnection but same error.

JsonObjectRequestSolaire jsonRequest = new JsonObjectRequestSolaire(method, URL, object, headers, responseListener, errorListener);
    RetryPolicy policy = new DefaultRetryPolicy(TIMEOUT, DefaultRetryPolicy.DEFAULT_MAX_RETRIES, DefaultRetryPolicy.DEFAULT_BACKOFF_MULT);
    jsonRequest.setRetryPolicy(policy);
    jsonRequest.setShouldCache(false);

    OkHttpClient okHttpClient = new OkHttpClient.Builder()
            .certificatePinner(new CertificatePinner.Builder()
                    .add("my_domain", "sha256/shaKey")//example.com
                    .add("my_domain", "sha256/shaKey")//also tried *.example.com
                    .build())
            .build();

    //HttpsURLConnection.setDefaultHostnameVerifier(okHttpClient.hostnameVerifier());
    //HttpsURLConnection.setDefaultSSLSocketFactory(okHttpClient.sslSocketFactory());

    RequestQueue requestQueue = Volley.newRequestQueue(activity.getApplicationContext(), new HurlStack(null, okHttpClient.sslSocketFactory()));
    requestQueue.add(jsonRequest);

by using trustKit our iOS guy implemented and it is working for him.

Thanks in Advance.

Please share your valuable input here, so that i can understand this SSL pinning concept.

SSL Pinning using Google Volley

1 Answers