title: How to properly verify SSL certificate in using HttpURLConnection?
body: <p>Recently <strong>JSSA (Japan Smartphone Security Association)</strong> issued the 2017 edition of their <strong>Android Application Secure Design/Secure Coding Guidebook</strong> in which they have given examples of communicating via HTTPS with trusted as well as private certificates. For trusted certificate the code is supposed to check for:</p>
  
  <ul>
  <li>The server certificate is signed by a trusted third party certificate
  authority</li>
  <li>The period and other properties of the server certificate are valid</li>
  <li>The server's host name matches the CN (Common Name) or SAN (Subject
  Alternative Names) in the Subject field of the server certificate</li>
  </ul>
  
  <p>The example code they have given for connecting to a secure server with trusted certificate is same as normal HTTP unsecured connection as below</p>
  
  <pre><code>.
  .
  
  URL url = new URL(strUrl);
  response = (HttpURLConnection) url.openConnection();
  response.setRequestMethod("GET");
  response.connect();
  checkResponse(response);
  .
  .
  </code></pre>
  
  <p>However, the sample given for private certificate connection seems to be a bit more elaborate and looks adequate for its intended purpose. </p>
  
  <p>Expecting expert advice on the credibility of the sample code in securing the transaction, since they are not even using <strong>HttpsURLConnection</strong>, or any or all of the above mentioned validation goals seems to be left unaddressed as per the given sample code. </p>
  
  <p>Thanks in advance.</p>
  
  <p>PS: The document link for reference.
  <a href="http://www.jssec.org/dl/android_securecoding_en.pdf" rel="nofollow noreferrer">http://www.jssec.org/dl/android_securecoding_en.pdf</a></p>