You are using an unsafe implementation of X509TrustManager

Question

I've an app in Google Play, today I received a mail from Google saying that:

Google Play warning: You are using an unsafe implementation of X509TrustManager

It says something about the SSL certificate issues and a way to solve the issue.

I'm asking this question because of curiosity,

1. Actually what is this warning all about ?
2. I'm not using any network related activities in my app (it's a local database driven app), so why this warning occurred for my app?

More Details:

My app was built using Appcelerator Titanium and google says this implementation is in ti.modules.titanium.network.NonValidatingTrustManager;. I'm sure that I never used such a class in my code.

Answer 1

Actually what is this warning all about ?

You should have been linked to this page, which explains what it is all about. In a nutshell, Google is scanning apps for people who screw up SSL, such as blindly accepting all certificates as valid.

I'm not using any network related activities in my app (it's a local database driven app), so why this warning occurred for my app?

Because something else in your APK has done this. In the case of this developer, it was a library.

My app was built using Appcelerator Titanium and google says this implementation is in ti.modules.titanium.network.NonValidatingTrustManager;. I'm sure that I never used such a class in my code.

You may not have used it directly. However, something else is using it. Or, perhaps it is there because it is just part of the overall Titanium framework and remains in your APK.

Answer 2

Appcelerator is tracking this issue on JIRA here: https://jira.appcelerator.org/browse/TIMOB-20431

We also put out a blog post with information here: http://www.appcelerator.com/blog/2016/02/google-security-alert-unsafe-implementation-of-the-interface-x509trustmanager/

The email speaks about a May 17th deadline for newly submitted (!) apps and updates. We will have a fix and instructions ready in time.

Answer 3

Read this: http://docs.appcelerator.com/platform/latest/#!/guide/SSL_Certificate_Store_Support_for_HTTP_Clients

It all about the Google pushing everybody to use https. If you are using into your app the Titanium.Network.createHTTPClient object, then you will have to implement that with this:

var certificateStore = require('ti.certificatestore').

The module can be find here: https://github.com/appcelerator-modules/ti.certificatestore

Answer 4

The problem is not related to the js code. It is inside Titanium sdk and no matter do you use some fucntions or not. I think the possible solution is to rewrite class https://github.com/appcelerator/titanium_mobile/blob/bc85170157d3bebc5de1d61a9fe6e34bce84a8c9/android/modules/network/src/java/ti/modules/titanium/network/NonValidatingTrustManager.java

We should create safe implementation of X509TrustManager