1. Overview
In this tutorial, we’ll see how to create and configure an OkHttpClient to trust all certificates.
Take a look at our articles about OkHttp for more specifics on the library.
2. Maven Dependency
Let’s start by adding the OkHttp dependency to our pom.xml file:
<dependency>
<groupId>com.squareup.okhttp3</groupId>
<artifactId>okhttp</artifactId>
<version>5.0.0-alpha.12</version>
</dependency>
3. Use a Normal OkHttpClient
First, let’s take a standard OkHttpClient object and call a web page with an expired certificate:
OkHttpClient client = new OkHttpClient.Builder().build();
client.newCall(new Request.Builder().url("https://expired.badssl.com/").build()).execute();
The stack trace output will look like this:
sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: validity check failed
Now, let’s see the error received when we try another website with a self-signed certificate:
sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
And let’s try a website with a wrong-host certificate:
Hostname wrong.host.badssl.com not verified
As we see, by default, OkHttpClient will throw errors if calling sites to have bad certificates. So next, we’ll see how to create and configure an OkHttpClient to trust all certificates.
4. Set Up an OkHttpClient to Trust All Certificates
Let’s create our array of TrustManager containing a single X509TrustManager that disables the default certificate validations by overriding their methods:
TrustManager[] trustAllCerts = new TrustManager[]{
new X509TrustManager() {
@Override
public void checkClientTrusted(java.security.cert.X509Certificate[] chain, String authType) {
}
@Override
public void checkServerTrusted(java.security.cert.X509Certificate[] chain, String authType) {
}
@Override
public java.security.cert.X509Certificate[] getAcceptedIssuers() {
return new java.security.cert.X509Certificate[]{};
}
}
};
We’ll use this array of TrustManager to create an SSLContext:
SSLContext sslContext = SSLContext.getInstance("SSL");
sslContext.init(null, trustAllCerts, new java.security.SecureRandom());
And then, we’ll use this SSLContext to set the OkHttpClient builder’s SSLSocketFactory:
OkHttpClient.Builder newBuilder = new OkHttpClient.Builder();
newBuilder.sslSocketFactory(sslContext.getSocketFactory(), (X509TrustManager) trustAllCerts[0]);
newBuilder.hostnameVerifier((hostname, session) -> true);
We also set the new Builder‘s HostnameVerifier to a new HostnameVerifier object whose verification method always returns true.
Finally, we can get a new OkHttpClient object and call the sites with bad certificates again without any error:
OkHttpClient newClient = newBuilder.build();
newClient.newCall(new Request.Builder().url("https://expired.badssl.com/").build()).execute();
5. Conclusion
In this short article, we’ve seen how to create and configure an OkHttpClient to trust all certificates. Of course, trusting all certificates is not recommended. However, there may be some cases where we will need it.
The complete code for this article is available over on GitHub.
