android 与 https

1.官方文档

android https	https://developer.android.google.cn/training/articles/security-ssl
android 配置ca	https://developer.android.google.cn/training/articles/security-config 自签名证书配置、network_security_config.xml语法等
okhttp  配置ca	https://square.github.io/okhttp/https/#customizing-trusted-certificates-kt-java

2.android 上使用自签名证书

2.1 生成证书

　　参考：　https://www.cnblogs.com/sjjg/p/15327857.html

2.2 在代码中设置ca示例

• HttpsURLConnection

  // Load CAs from an InputStream
      // (could be from a resource or ByteArrayInputStream or ...)
      val cf: CertificateFactory = CertificateFactory.getInstance("X.509")
      // From https://www.washington.edu/itconnect/security/ca/load-der.crt
      val caInput: InputStream = BufferedInputStream(FileInputStream("load-der.crt"))
      val ca: X509Certificate = caInput.use {
          cf.generateCertificate(it) as X509Certificate
      }
      System.out.println("ca=" + ca.subjectDN)
  
      // Create a KeyStore containing our trusted CAs
      val keyStoreType = KeyStore.getDefaultType()
      val keyStore = KeyStore.getInstance(keyStoreType).apply {
          load(null, null)
          setCertificateEntry("ca", ca)
      }
  
      // Create a TrustManager that trusts the CAs inputStream our KeyStore
      val tmfAlgorithm: String = TrustManagerFactory.getDefaultAlgorithm()
      val tmf: TrustManagerFactory = TrustManagerFactory.getInstance(tmfAlgorithm).apply {
          init(keyStore)
      }
  
      // Create an SSLContext that uses our TrustManager
      val context: SSLContext = SSLContext.getInstance("TLS").apply {
          init(null, tmf.trustManagers, null)
      }
  
      // Tell the URLConnection to use a SocketFactory from our SSLContext
      val url = URL("https://certs.cac.washington.edu/CAtest/")
      val urlConnection = url.openConnection() as HttpsURLConnection
      urlConnection.sslSocketFactory = context.socketFactory
      val inputStream: InputStream = urlConnection.inputStream
      copyInputStreamToOutputStream(inputStream, System.out)

• okhttp

  private val client: OkHttpClient
  
    init {
      val trustManager = trustManagerForCertificates(trustedCertificatesInputStream())
      val sslContext = SSLContext.getInstance("TLS")
      sslContext.init(null, arrayOf<TrustManager>(trustManager), null)
      val sslSocketFactory = sslContext.socketFactory
  
      client = OkHttpClient.Builder()
          .sslSocketFactory(sslSocketFactory, trustManager)
          .build()
    }
  
    fun run() {
      val request = Request.Builder()
          .url("https://publicobject.com/helloworld.txt")
          .build()
  
      client.newCall(request).execute().use { response ->
        if (!response.isSuccessful) throw IOException("Unexpected code $response")
  
        for ((name, value) in response.headers) {
          println("$name: $value")
        }
  
        println(response.body!!.string())
      }
    }
  
    /**
     * Returns an input stream containing one or more certificate PEM files. This implementation just
     * embeds the PEM files in Java strings; most applications will instead read this from a resource
     * file that gets bundled with the application.
     */
    private fun trustedCertificatesInputStream(): InputStream {
      ... // Full source omitted. See sample.
    }
  
    private fun trustManagerForCertificates(inputStream: InputStream): X509TrustManager {
      ... // Full source omitted. See sample.
    }

3.android 应用内配置ca

　　target <= 23 的应用默认情况下会信任用户添加的 CA ，应用可以在res/xml/network_security_config.xml 内，使用 

• base-config（应用范围的自定义）
• domain-config（针对每个域名的自定义）

　　它的配置如下：

    <base-config cleartextTrafficPermitted="true">
        <trust-anchors>
            <certificates src="system" />
            <certificates src="user" />
        </trust-anchors>
    </base-config>

　　当( 23 < target <= 27) 时，它的默认配置如下：

     <base-config cleartextTrafficPermitted="true">
         <trust-anchors>
             <certificates src="system" />
         </trust-anchors>
     </base-config>

　　当 target > 27时，cleartextTrafficPermitted="false" 表示不支持明文传输。

3.1 配置自定义 CA

    <?xml version="1.0" encoding="utf-8"?>
    <network-security-config>
        <domain-config>
            <domain includeSubdomains="true">example.com</domain>
            <trust-anchors>
                <certificates src="@raw/my_ca"/>
            </trust-anchors>
        </domain-config>
    </network-security-config>

证书 以 PEM 或 DER 格式。如果使用 PEM 格式，文件必须仅包含 PEM 数据，且没有额外的文本。

3.2 限制可信CA集

    <?xml version="1.0" encoding="utf-8"?>
    <network-security-config>
        <domain-config>
            <domain includeSubdomains="true">secure.example.com</domain>
            <domain includeSubdomains="true">cdn.example.com</domain>
            <trust-anchors>
                <certificates src="@raw/trusted_roots1"/>
                <certificates src="@raw/trusted_roots2"/>
                ...
            </trust-anchors>
        </domain-config>
    </network-security-config>

3.3 信任其他 CA

    <?xml version="1.0" encoding="utf-8"?>
    <network-security-config>
        <base-config>
            <trust-anchors>
                <certificates src="@raw/extracas"/>
                <certificates src="system"/>
            </trust-anchors>
        </base-config>
    </network-security-config>

3.4 固定证书

一般情况下，应用信任所有预装 CA。如果有预装 CA 颁发了欺诈性证书，则应用将面临被中间人攻击的风险。有些应用选择通过限制信任的 CA 集或通过固定证书来限制其接受的证书集。

如需固定证书，您可以通过按公钥的哈希值（X.509 证书的 SubjectPublicKeyInfo）提供证书集。然后，只有至少包含一个已固定公钥的证书链才有效。

　　详见 ： https://developer.android.google.cn/training/articles/security-config#CertificatePinning

    <?xml version="1.0" encoding="utf-8"?>
    <network-security-config>
        <domain-config>
            <domain includeSubdomains="true">example.com</domain>
            <pin-set expiration="2018-01-01">
                <pin digest="SHA-256">7HIpactkIAq2Y49orFOOQKurWxmmSFZhBCoQYcRhJ3Y=</pin>
                <!-- backup pin -->
                <pin digest="SHA-256">fwza0LRMXouZHRC8Ei+4PyuldPDcf3UKgO/04cDM1oE=</pin>
            </pin-set>
        </domain-config>
    </network-security-config>

4.安全测试工具

　　Nogotofai

　　　　https://github.com/google/nogotofail