Take the 2-minute tour ×

I am not an expert on keystores and have a hard time understanding the nuances of this but this is how far I got:

In creating a xmpp-connection using the asmack build found here one still has to change the truststore, which usually, so say multiple sources on the web, is done using these commands

ConnectionConfiguration config = new ConnectionConfiguration(host, Integer.parseInt(port), service);
XMPPConnection connection = new XMPPConnection(connConfig);

This works find for older Android versions but under ICS they changed some things and now it does not anymore.The path now is diferent.

Apparently this can be fixed but I have no earthly idea how.

What is needed, obviously, is a method that returns the path depending on SDK version that returns the needed string to set the sdk-path since you can not just return the keystore itself to the xmpp-connection.

In reference to this that method would look like this:

private String getTrustStorePath() 
 String path = System.getProperty("javax.net.ssl.trustStore");

 if (path == null) 
  if ( Build.VERSION.SDK_INT >= 14 ) 
   path = "/system/etc/security/cacerts.bks";

  return path;

Here a commenter says that under Android "4.x; /etc/security/cacerts.bks was replaced with the directory/etc/security/cacerts/ containing the certs as individual PEM encoded files." however, I do not know what relevance, if any, this has.

I have also checked out the code of two projects using xmpp and asmack (gtalksms and yaxim but did not see how they avoid this problem.

share|improve this question
I am also currently investigating this. We have lately changed how we detect the truststore path on GTalkSMS as it can also be seen here. But I am pretty sure that this is not enough... –  Flow Jun 2 '12 at 11:15

2 Answers 2

up vote 1 down vote accepted

Try this:

} else {
    String path = System.getProperty("javax.net.ssl.trustStore");
    if (path == null)
        path = System.getProperty("java.home") + File.separator + "etc"
            + File.separator + "security" + File.separator
            + "cacerts.bks";

See https://github.com/Flowdalic/asmack/wiki/Truststore and some background explanation at http://nelenkov.blogspot.com/2011/12/ics-trust-store-implementation.html.

share|improve this answer
Hi, I used above code for Jellybean, so it works fine, also I can authenticate users. But I also see an caught exception java.lang.NullPointerException Its thrown from proceedTLSReceived, which in turns call ServerTrustManager. It crashes for configuration.getTruststorePath(). Any idea? –  anargund May 23 '13 at 0:45
@anargund I see the same issue as well. ICS and JellyBean. –  Geebs Jun 4 '13 at 12:14
@Geebs I resolved it. I downloaded latest version of jar file from asmack website. I was having problem before because I was using some old jar file. As soon as I started using latest one, most of the problems were resolved. –  anargund Jun 4 '13 at 20:34
@anargund thanks for the update –  Geebs Aug 18 '13 at 3:30
how to create the trust store path and those background,kindly expalin those things too @Phillip –  Karthick M Apr 4 at 6:36

The trust store in ICS is not in a single .bks file any more, but in separate PEM-encoded files in the /system/etc/security/cacerts directory. User-added certs can be placed in /data/misc/keychain/cacerts-added. More details can be found here.

Your cert file must be named as: subject-hash.N where N is an sequential integer starting from 0 (usually just 0, but if 0 is already used, then 1, etc).

To get the subject-hash of your cert, you can use openssl like this: openssl x509 -noout -subject_hash_old -in my-cert-file.pem

share|improve this answer
Thanks but how then can one configure the connection, which requres to set a path of a truststore if this does no longer exist? jivesoftware.smack.ConnectionConfiguration requres the use of setTruststorePath because at the end the result needs to be an XMPP-Connection. –  Lukas Ruge Aug 29 '12 at 7:47
Or, to go a different direction: can I create a connection without setting the trust store at all? An untrusted connection so to speak. –  Lukas Ruge Sep 3 '12 at 7:43
Have you tried the answer of Phillip? In ICS you don't need to set trust store path, only the trust store type "AndroidCAStore". –  rustyx Sep 3 '12 at 8:35
Yes, I tried and it (almost) worked (I think the error was in my surrounding code though). I have now reduced it even further, not using any kind of trustsore or encryption. Basically the bare minimum as shown here. This of course lacks any security but seems to work for now letting me work on other stuff... –  Lukas Ruge Sep 3 '12 at 8:52

Your Answer


