{"action":"created","issue":{"url":"https://api.github.com/repos/square/okhttp/issues/2786","repository_url":"https://api.github.com/repos/square/okhttp","labels_url":"https://api.github.com/repos/square/okhttp/issues/2786/labels{/name}","comments_url":"https://api.github.com/repos/square/okhttp/issues/2786/comments","events_url":"https://api.github.com/repos/square/okhttp/issues/2786/events","html_url":"https://github.com/square/okhttp/issues/2786","id":170677599,"number":2786,"title":"SSLSocketFactory with Client Certificate works fine with okhttp2 but not with okhttp3","user":{"login":"mboukadir","id":795846,"avatar_url":"https://avatars.githubusercontent.com/u/795846?v=3","gravatar_id":"","url":"https://api.github.com/users/mboukadir","html_url":"https://github.com/mboukadir","followers_url":"https://api.github.com/users/mboukadir/followers","following_url":"https://api.github.com/users/mboukadir/following{/other_user}","gists_url":"https://api.github.com/users/mboukadir/gists{/gist_id}","starred_url":"https://api.github.com/users/mboukadir/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mboukadir/subscriptions","organizations_url":"https://api.github.com/users/mboukadir/orgs","repos_url":"https://api.github.com/users/mboukadir/repos","events_url":"https://api.github.com/users/mboukadir/events{/privacy}","received_events_url":"https://api.github.com/users/mboukadir/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/square/okhttp/labels/bug","name":"bug","color":"fc2929"},{"url":"https://api.github.com/repos/square/okhttp/labels/needs%20info","name":"needs info","color":"eb6420"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/square/okhttp/milestones/6","html_url":"https://github.com/square/okhttp/milestones/Icebox","labels_url":"https://api.github.com/repos/square/okhttp/milestones/6/labels","id":606107,"number":6,"title":"Icebox","description":null,"creator":{"login":"swankjesse","id":133019,"avatar_url":"https://avatars.githubusercontent.com/u/133019?v=3","gravatar_id":"","url":"https://api.github.com/users/swankjesse","html_url":"https://github.com/swankjesse","followers_url":"https://api.github.com/users/swankjesse/followers","following_url":"https://api.github.com/users/swankjesse/following{/other_user}","gists_url":"https://api.github.com/users/swankjesse/gists{/gist_id}","starred_url":"https://api.github.com/users/swankjesse/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/swankjesse/subscriptions","organizations_url":"https://api.github.com/users/swankjesse/orgs","repos_url":"https://api.github.com/users/swankjesse/repos","events_url":"https://api.github.com/users/swankjesse/events{/privacy}","received_events_url":"https://api.github.com/users/swankjesse/received_events","type":"User","site_admin":false},"open_issues":53,"closed_issues":32,"state":"open","created_at":"2014-03-22T02:57:09Z","updated_at":"2016-08-19T04:23:38Z","due_on":null,"closed_at":null},"comments":9,"created_at":"2016-08-11T15:40:53Z","updated_at":"2016-08-19T16:45:53Z","closed_at":null,"body":"Here's how I created the SSLSocketFactory  that works fine with okhttp2.x but not with okhttp3:\r\n```\r\npublic SSLSocketFactory createSslSocketFactory() {\r\n    try {\r\n      String base64PKCS12 = \"****';\r\n      String certPassword = \"****\";\r\n\r\n      InputStream is = new ByteArrayInputStream(base64PKCS12.getBytes());\r\n      Base64InputStream b64is = new Base64InputStream(is, Base64.DEFAULT);\r\n\r\n      char[] tableauCertPassword = certPassword.toCharArray();\r\n\r\n      // Import PKCS12 in KeyStore\r\n      KeyStore appKeyStore = KeyStore.getInstance(\"PKCS12\");\r\n      appKeyStore.load(b64is, tableauCertPassword);\r\n\r\n      is.close();\r\n      b64is.close();\r\n\r\n      // Building SSL context for future use\r\n      KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(\"X509\");\r\n      keyManagerFactory.init(appKeyStore, tableauCertPassword);\r\n      KeyManager[] keyManagers = keyManagerFactory.getKeyManagers();\r\n\r\n      // Add Trustmanager\r\n      KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());\r\n      InputStream instream = app.getResources().openRawResource(R.raw.truststore);\r\n      trustStore.load(instream, \"*****\".toCharArray());\r\n      instream.close();\r\n\r\n      TrustManagerFactory tmf =\r\n          TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());\r\n      tmf.init(trustStore);\r\n      TrustManager[] managers = tmf.getTrustManagers();\r\n\r\n      SSLContext context = SSLContext.getInstance(\"TLS\");\r\n      context.init(keyManagers, managers, null);\r\n\r\n      return context.getSocketFactory();\r\n    } catch (Exception e) {\r\n      Timber.e(e, \"SSLSocket creation exception %s\", e.getMessage());\r\n      throw new AssertionError(e);\r\n    }\r\n  }\r\n```\r\n With okhttp3 i have tried this, as  @swankjesse did in : exemple CutomTust [https://github.com/square/okhttp/blob/master/samples/guide/src/main/java/okhttp3/recipes/CustomTrust.java],  but in my case I have to use **TrustStore**  : \r\n\r\n\r\n\r\n```\r\n\r\nprivate KeyManager[] keyManagers;\r\n\r\n  OkHttpClient provideOkHttpClient(Application app) {\r\n    X509TrustManager trustManager = trustManagerForCertificates(app);\r\n    SSLContext sslContext = null;\r\n    try {\r\n      sslContext = SSLContext.getInstance(\"TLS\");\r\n      sslContext.init(keyManagers, new TrustManager[] { trustManager }, null);\r\n    } catch (GeneralSecurityException e) {\r\n      throw new RuntimeException(e);\r\n    }\r\n\r\n    return new OkHttpClient.Builder()//\r\n        .sslSocketFactory(sslContext.getSocketFactory(),trustManager)//\r\n        .addInterceptor(new HostSelectionInterceptor()).build();\r\n  }\r\n\r\n  public  X509TrustManager trustManagerForCertificates(Application app) {\r\n\r\n    try {\r\n      String base64PKCS12 = \"**\";\r\n      String certPassword = \"**\";\r\n\r\n      InputStream is = new ByteArrayInputStream(base64PKCS12.getBytes());\r\n      Base64InputStream b64is = new Base64InputStream(is, Base64.DEFAULT);\r\n\r\n      char[] tableauCertPassword = certPassword.toCharArray();\r\n\r\n      // Import PKCS12 in KeyStore\r\n      KeyStore appKeyStore = KeyStore.getInstance(\"PKCS12\");\r\n      appKeyStore.load(b64is, tableauCertPassword);\r\n\r\n      is.close();\r\n      b64is.close();\r\n      \r\n```\r\nHere is where I manage the **TRUSTSTORE** \r\n ```\r\n  // Add Trustmanager\r\n      KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());\r\n      InputStream instream = app.getResources().openRawResource(R.raw.truststore);\r\n      trustStore.load(instream, \"****\".toCharArray());\r\n      instream.close();\r\n\r\n```\r\n      \r\n```\r\n// Building SSL context for future use\r\n      KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(\"X509\");\r\n      keyManagerFactory.init(appKeyStore, tableauCertPassword);\r\n      keyManagers = keyManagerFactory.getKeyManagers();\r\n\r\n\r\n \r\n     TrustManagerFactory tmf =\r\n          TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());\r\n      tmf.init(trustStore );\r\n\r\n      TrustManager[] trustManagers = tmf.getTrustManagers();\r\n\r\n      if (trustManagers.length != 1 || !(trustManagers[0] instanceof X509TrustManager)) {\r\n        throw new IllegalStateException(\r\n            \"Unexpected default trust managers:\" + Arrays.toString(trustManagers));\r\n      }\r\n      return (X509TrustManager) trustManagers[0];\r\n    } catch (Exception e) {\r\n      Timber.e(e, \"SSLSocket creation exception %s\", e.getMessage());\r\n      throw new AssertionError(e);\r\n    }\r\n  }\r\n\r\n```\r\n\r\nThanks in advance\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/square/okhttp/issues/comments/241070350","html_url":"https://github.com/square/okhttp/issues/2786#issuecomment-241070350","issue_url":"https://api.github.com/repos/square/okhttp/issues/2786","id":241070350,"user":{"login":"mboukadir","id":795846,"avatar_url":"https://avatars.githubusercontent.com/u/795846?v=3","gravatar_id":"","url":"https://api.github.com/users/mboukadir","html_url":"https://github.com/mboukadir","followers_url":"https://api.github.com/users/mboukadir/followers","following_url":"https://api.github.com/users/mboukadir/following{/other_user}","gists_url":"https://api.github.com/users/mboukadir/gists{/gist_id}","starred_url":"https://api.github.com/users/mboukadir/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mboukadir/subscriptions","organizations_url":"https://api.github.com/users/mboukadir/orgs","repos_url":"https://api.github.com/users/mboukadir/repos","events_url":"https://api.github.com/users/mboukadir/events{/privacy}","received_events_url":"https://api.github.com/users/mboukadir/received_events","type":"User","site_admin":false},"created_at":"2016-08-19T16:45:53Z","updated_at":"2016-08-19T16:45:53Z","body":"I would love to contribute in solving the problem.\r\nHowever, I cannot share the client certificates, due to confidentiality issues.\r\nIn addition the company I am working does not allow running tests on their servers with mocked certificates. \r\nKeep in mind that in order to fix this bug, I am ready to help out."}}
{"actor":{"display_login":"mboukadir"}}