How to create a secure SSL connection between Android client and Java server?

Question

I'm trying to create a secure TCP/IP connection between my android client and java server. Cryptography by far is not my strong point. I know I have to use the Bouncy Castle keystores, but I'm stuck.

I need to create a self signed cert that I can use with the server and the client. This is where I'm stuck.

         InputStream clientTruststoreIs = getResources().openRawResource(R.raw.bks);
         KeyStore trustStore = null;
         trustStore = KeyStore.getInstance("BKS");
         trustStore.load(clientTruststoreIs, "123456".toCharArray());
        InetAddress serverAddr = InetAddress.getByName(serverIpAddress);
        SSLSocketFactory sslsocketfactory = (SSLSocketFactory) SSLSocketFactory.getDefault();

        sslSocket = (SSLSocket) sslsocketfactory.createSocket(serverAddr, 2222);
        inputStream =  sslSocket.getInputStream();  
        Log.d("TEST", "\n1 input");

It connects fine, it shows the connection on the server side, however the line inputStream = sslSocket.getInputStream() is completely locking/not returning. I'm not sure if I did any of the bouncy castle set up properly, or if the server is properly set up. Please help, I'm at my wits' end....

Edit: I modified the server so that it sends data upon connection and still nothing, and I changed the order of where I get my input and output streams, and then it locked where I was getting the output stream:

        sslSocket = (SSLSocket) sslsocketfactory.createSocket(serverAddr, 9999);
        outputStream = sslSocket.getOutputStream();
        Log.d("test", "--**--- created socket 2.0 outputsreams"); // does not reach here
        outputStreamWriter = new OutputStreamWriter(outputStream);
        bufferedWriter = new  BufferedWriter(outputStreamWriter);         
        inputStream =  sslSocket.getInputStream();  
        inputStreamReader = new InputStreamReader(inputStream);
        bufferedReader = new BufferedReader(inputStreamReader);
        ...
        String line = bufferedReader.readLine(); // where I'd expect it to lock...

So still no luck, no timeout, no exception, it just waits there...

Solution 1

I think your problem is similar to this. The same workflow holds for SSL socket connections:

However, the basics are much the same as they are in this program:

Open a socket.

Open an input stream and output stream to the socket.

Read from and write to the stream according to the server's protocol, call flush() on the stream when you are done with a message.

Close the streams.

Close the socket.

So you should

1. Send a request to your server first by writing to the server's OutputStream from the client side, flush when you're done.
2. The server will then receive the message through its InputStream and can in return write to its OutputStream, again flushing when done.
3. Read the response from the client side using the InputStream, start from 1. until you are done.

Finally, you should close all streams.

Flushing and sending a request first before trying to read a response on the client side should stop the "hanging behaviour".

---

Edit: Are you sure that you use SSLServerSocketFactory on the server? It looks like you are trying to use SSLSocketFactory both for client and server. That's not going to work. I googled this tutorial, that's basically similar to what your code should look like.

Solution 2

You might try instead the org.apache.http.conn.ssl.SSLSocketFactory class, and in particular this constructor.

EDIT March 26, 2017:

Ignore what I wrote above, that class is deprecated as part of the deprecation of the Apache HTTP client on Android. Android is instead maintaining and enhancing the standard HttpURLConnection and HttpsURLConnection classes. See this for a full explanation.

Comments

[Vijju]

Hey! @ajacian81 can u tell me how u authenticate client ?

[ajacian81]

I don't think that's where it should lock. Where it should lock is later... see my edit for more info.