Mutual authentication using Retrofit Android

Question

I need to send a .CRT and .KEY file on an api request. I managed to do the request using Postman, but I don't know how to pass the key in the android code. enter image description here

CRT:

-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----

KEY:

-----BEGIN RSA PRIVATE KEY-----
-----END RSA PRIVATE KEY-----

This is my client

fun getClient(url: String, context: Context): Retrofit {

        // Loading CAs from an InputStream
        val cf: CertificateFactory = CertificateFactory.getInstance("X.509")

        val ca: Certificate = context.resources.openRawResource(R.raw.crt).use { cert ->  cf.generateCertificate(cert) }

        // Creating a KeyStore containing our trusted CAs
        val keyStoreType = KeyStore.getDefaultType()
        val keyStore = KeyStore.getInstance(keyStoreType).apply {
            load(null, null)
            setCertificateEntry("ca", ca)
        }

        // Creating a TrustManager that trusts the CAs in our KeyStore.
        val tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm()
        val tmf = TrustManagerFactory.getInstance(tmfAlgorithm).apply {
            init(keyStore)
        }

        val trustManager: X509TrustManager = tmf.trustManagers[0] as X509TrustManager

        // Creating an SSLSocketFactory that uses our TrustManager
        val sslContext = SSLContext.getInstance("TLS").apply {
            init(null, arrayOf<TrustManager>(trustManager), null)
        }

        val okHttpClient = OkHttpClient.Builder()
            .sslSocketFactory(sslContext.socketFactory, trustManager)
            .build()

        val json = GsonBuilder().setLenient().create()

        return Retrofit
            .Builder()
            .baseUrl(url)
            .client(okHttpClient)
            .addCallAdapterFactory(RxJavaCallAdapterFactory.create())
            .addConverterFactory(GsonConverterFactory.create(json))
            .build()
    }

The call return a throwable:

java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.

I appreciate it who can help me. Sorry for my bad english.

Hakan54 · Accepted Answer

It looks like your Retrofit ssl configuration does not match how you have configured postman. In postman you have configured it to have a private key and a certificate chain within the client certificate configuration section. The trusted certificates/CA's are empty. Now if we compare that with your retro fit configuration I can see that you have added the certificate.crt file as a trusted certificate instead of a client key material.

It is hard to replicate the exact same situation as we don't posses the certificates, so I am grabbing one from https://badssl.com/ which we can use to easily test this use case.

I am adding the certificates here, but you may need to get a new one from the website itself as they will expire.

You basically need 3 files for this use case:

client private key
client certificate chain
trusted server certificate

1. client private key

2. client certificate chain

3. trusted server certificate

There are multiple ways to load these files into your application and transform them into the right ssl materials. With vanilla java you might need to adjust it if your pem files (private key) have different headers. But with the above example the snippet below should work:

Option 1

import javax.net.ssl.KeyManager;
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSocketFactory;
import javax.net.ssl.TrustManager;
import javax.net.ssl.TrustManagerFactory;
import java.io.IOException;
import java.io.InputStream;
import java.nio.charset.Charset;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.nio.file.StandardOpenOption;
import java.security.KeyFactory;
import java.security.KeyStore;
import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;
import java.security.cert.Certificate;
import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
import java.security.spec.PKCS8EncodedKeySpec;
import java.util.Base64;

public class App {

    public static void main(String[] args) throws Exception {
        CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");

        InputStream trustedCertificateAsInputStream = Files.newInputStream(Paths.get("badssl-server-certificate.pem"), StandardOpenOption.READ);
        Certificate trustedCertificate = certificateFactory.generateCertificate(trustedCertificateAsInputStream);
        KeyStore trustStore = createEmptyKeyStore("secret".toCharArray());
        trustStore.setCertificateEntry("badssl-server", trustedCertificate);

        String privateKeyContent = new String(Files.readAllBytes(Paths.get("private-key-badssl.pem")), Charset.defaultCharset())
                .replace("-----BEGIN PRIVATE KEY-----", "")
                .replaceAll(System.lineSeparator(), "")
                .replace("-----END PRIVATE KEY-----", "");

        byte[] privateKeyAsBytes = Base64.getDecoder().decode(privateKeyContent);
        KeyFactory keyFactory = KeyFactory.getInstance("RSA");
        PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(privateKeyAsBytes);

        InputStream certificateChainAsInputStream = Files.newInputStream(Paths.get("certificate-chain-badssl.pem"), StandardOpenOption.READ);
        Certificate certificateChain = certificateFactory.generateCertificate(certificateChainAsInputStream);

        KeyStore identityStore = createEmptyKeyStore("secret".toCharArray());
        identityStore.setKeyEntry("client", keyFactory.generatePrivate(keySpec), "".toCharArray(), new Certificate[]{certificateChain});

        trustedCertificateAsInputStream.close();
        certificateChainAsInputStream.close();

        TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        trustManagerFactory.init(trustStore);
        TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();

        KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
        keyManagerFactory.init(identityStore, "secret".toCharArray());
        KeyManager[] keyManagers = keyManagerFactory.getKeyManagers();

        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(keyManagers, trustManagers, null);

        SSLSocketFactory socketFactory = sslContext.getSocketFactory();


        val okHttpClient = OkHttpClient.Builder()
                .sslSocketFactory(socketFactory, trustManagers[0])
                .build()

        val json = GsonBuilder().setLenient().create()

        val retrofit = Retrofit.Builder()
                .baseUrl("https://client.badssl.com/")
                .client(okHttpClient)
                .addConverterFactory(GsonConverterFactory.create(json))
                .build()
    }

    public static KeyStore createEmptyKeyStore(char[] keyStorePassword) throws CertificateException, NoSuchAlgorithmException, IOException, KeyStoreException {
        KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
        keyStore.load(null, keyStorePassword);
        return keyStore;
    }

}

It is a bit verbose, but this should do the trick. I have written this in vanilla java, however your IDEA should be able to convert this easily to kotlin.

There is also an alternative for the above setup, which I made available within my own library, see here: GitHub - SSLContext Kickstart see below for an example usage under option 2.

Option 2

X509ExtendedKeyManager keyManager = PemUtils.loadIdentityMaterial("certificate-chain-badssl.pem", "private-key-badssl.pem");
X509ExtendedTrustManager trustManager = PemUtils.loadTrustMaterial("badssl-server-certificate.pem");

SSLFactory sslFactory = SSLFactory.builder()
          .withIdentityMaterial(keyManager)
          .withTrustMaterial(trustManager)
          .build();

val okHttpClient = OkHttpClient.Builder()
        .sslSocketFactory(sslFactory.getSslSocketFactory(), sslFactory.getTrustManager().get())
        .build()

val json = GsonBuilder().setLenient().create()

val retrofit = Retrofit.Builder()
        .baseUrl("https://client.badssl.com/")
        .client(okHttpClient)
        .addConverterFactory(GsonConverterFactory.create(json))
        .build()

Mutual authentication using Retrofit Android

Tags:

android

ssl

kotlin

retrofit

mutual-authentication

Breno Cruz

1 Answers

Hakan54

Recent Activity

Donate For Us

Mutual authentication using Retrofit Android

Tags:

android

ssl

kotlin

retrofit

mutual-authentication

Breno Cruz

1 Answers

Hakan54

Related questions

Recent Activity

Donate For Us