java - Are self signed certificates always prone to man in the middle attack while adding the certificate programmatically? -

-

i creating jax-ws client app needs accept self-signed certificates. there common ssl handshake exception problem when trying import self-signed certificates. common work around extend jsse security provider , initialize ssl context accept certificates like: 

security.addprovider(new com.sun.net.ssl.internal.ssl.provider()); trustmanager[] trustcerts = new trustmanager[]{new x509trustmanager() {                         public x509certificate[] getacceptedissuers() {                             return null;                         }                         public void checkservertrusted(x509certificate[]                        certs, string authtype) throws certificateexception {                             return;                         }                          public void checkclienttrusted(x509certificate[]                         certs, string authtype) throws certificateexception {                             return;                         }                     }             };  sslcontext sc = sslcontext.getinstance("sslv3"); sc.init(null, trustcerts, null); socketfactory factory = sc.getsocketfactory(); sslsocket socket; socket = (sslsocket) factory.createsocket(minstance.gethostname(),getsecureconnectionendpoint().getport()); socket.starthandshake(); setcerts(socket.getsession().getpeercertificates());

this workaround find problem. there many similar kind of questions here such import ssl certificates , propose same solution.

this prone man in middle attack , solution seems legit testing purposes.

so question, there no way of making whole process more secure when try import certificates programmatically?

thank in advance!

this prone man in middle attack , solution seems legit testing purposes.

correct. radically insecure.

so question, there no way of making whole process more secure when try import certificates programmatically?

not if via channel trying secure. certificate trusted needs delivered means.

nb code posted doesn't satisfy contract getacceptedissuers(). can't return null.


Comments

Post a Comment

Popular posts from this blog

qt - Using float or double for own QML classes -

-
i've created components , helper methods using c++ , qt used in qml gui. of methods calculate gui elements (size, transformations, scene graph items creation). target arm 32 bit using opengl / eglfs render output. opengl using float , qml using real (defined double ). what should use in c++ do not lose precision? if use qreal ( double ) shouldn't lose precision. if git grep float in qtbase.git , can find out bit more: dist/changes-5.2.0-**************************************************************************** dist/changes-5.2.0-* important behavior changes * dist/changes-5.2.0-**************************************************************************** dist/changes-5.2.0- dist/changes-5.2.0- - qt compiled qreal typedef'ed double on dist/changes-5.2.0: platforms. qreal float on arm chipsets before. guarantees more dist/changes-5.2.0- consistent behavior between platforms qt supports, binary dist/chan...
Read more

Create Outlook appointment via C# .Net -

-
i need create outlook appointment using microsoft.office.interop.outlook , while can work locally on own workstation , works if run web application via server's browser, not work when connect server externally. hence, think might permission issue. i changed application pool identity " localsystem " don't access denied error. unfortunately, doesn't work. the app behaves if appointment created, appointment doesn't appear in outlook. here include file on top of aspx.cs page using outlook = microsoft.office.interop.outlook; here code using pop appointment. outlook.application apptapp = new outlook.application(); outlook.appointmentitem appt = apptapp.createitem(outlook.olitemtype.olappointmentitem) outlook.appointmentitem; appt.subject = txtfirstname.text + " " + txtlastname.text; appt.body = txtcomment.text; appt.alldayevent = false; appt.start = datetime.parse(txtreminderdate.text + " 8:00 am"); appt.end = datetime.p...
Read more

ios - Swift Array Resetting Itself -

-
i have 2 arrays: pointhistory , datehistory . have nstimer , , when timer runs out, action called. in action appending int pointhistory , , current date string datehistory . here timer action: func timeraction() { let steppervalue = int(stepper.value) employee.numberofpoints = steppervalue networking.saveemployee(employee, completion: { (error) -> void in if error != nil { let alert = uialertcontroller(title: "error", message: "there error updating \(self.employee.name)'s points", preferredstyle: .alert) let alertaction = uialertaction(title: "ok", style: .cancel, handler: nil) alert.addaction(alertaction) self.presentviewcontroller(alert, animated: true, completion: nil) } }) var dateformatter = nsdateformatter() dateformatter.dateformat = "mm-dd-yyyy" dateformatter.timezone = nstimezone.localtimezone() var date = nsdate() var ...
Read more