17

I want to use SSL Pinning in volley network library. Is there any way to implement SSL pinning with volley? Does volley provide this support for security improvements?

3
  • Did you find anything?
    – Dimillian
    Commented Feb 2, 2015 at 10:26
  • Is the main purpose of this is to prevent MITM? If the attacker can reverse compile the APK and extract the cert, what is it really preventing? Commented Sep 9, 2019 at 19:00
  • @TakeshiKaga I don' t think you are quite right. Extracting public key from app won't help you perform MITM attack since you need private key. For better understanding, check how TLS works. What you can do is recompile app and change key but it makes vulnerable only your build. Commented Sep 9, 2020 at 14:35

5 Answers 5

13

I just implemented it like described here: http://blog.ostorlab.co/2016/05/ssl-pinning-in-android-networking.html

Here is the needed code for a volley-implementation:

CertificateFactory cf = CertificateFactory.getInstance("X.509");

// Generate the certificate using the certificate file under res/raw/cert.cer
InputStream caInput = new BufferedInputStream(getResources().openRawResource(R.raw.cert));
Certificate ca = cf.generateCertificate(caInput);
caInput.close();

// Create a KeyStore containing our trusted CAs
String keyStoreType = KeyStore.getDefaultType();
KeyStore trusted = KeyStore.getInstance(keyStoreType);
trusted.load(null, null);
trusted.setCertificateEntry("ca", ca);

// Create a TrustManager that trusts the CAs in our KeyStore
String tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
TrustManagerFactory tmf = TrustManagerFactory.getInstance(tmfAlgorithm);
tmf.init(trusted);

// Create an SSLContext that uses our TrustManager
SSLContext context = SSLContext.getInstance("TLS");
context.init(null, tmf.getTrustManagers(), null);

SSLSocketFactory sf = context.getSocketFactory();
mRequestQueue = Volley.newRequestQueue(mCtx.getApplicationContext(), new HurlStack(null, sf));

Seems to work!

2
  • It works for the first/second time, shows SSLHandshake Exception. However, doesn't work when you re-try, you will successfully get the network response.
    – Chandler
    Commented May 4, 2021 at 4:30
  • @Chandler have you found any solution for SSL pinning with volley?
    – tushar
    Commented May 4, 2023 at 3:35
2

I just looked into the same thing for a project I am working on. The position I am in may be different to you however.

I am using Volley with an OKHttp Network stack (https://gist.github.com/JakeWharton/5616899):

Add these to your Gradle Build:1

compile "com.squareup.okhttp:okhttp:2.7.5"
compile "com.squareup.okhttp:okhttp-urlconnection:2.7.5"

Add a OKHttpStack class;

public class OKHttpStack extends HurlStack {
    private final OkUrlFactory okUrlFactory;
    public OKHttpStack() {

        this(new OkUrlFactory( 
            new OkHttpClient.Builder()
                    .certificatePinner(
                        new CertificatePinner.Builder()
                            .add("example.com", "sha256/afwiKY3RxoMmLkuRW1l7QsPZTJPwDS2pdDROQjXw8ig=") //This is the cert
                            .build())
                    .build();
        ));
    }
    public OKHttpStack(OkUrlFactory okUrlFactory) {
        if (okUrlFactory == null) {
            throw new NullPointerException("Client must not be null.");
        }
        this.okUrlFactory = okUrlFactory;
    }

    @Override
    protected HttpURLConnection createConnection(URL url) throws IOException {
        return okUrlFactory.open(url);
    }
}

When you then create your RequestQueue do something like:

Network network = new BasicNetwork(new OKHttpStack());
File cacheDir = new File(context.getCacheDir(), "volley");
int threads = 4;
mRequestQueue = new RequestQueue(new DiskBasedCache(cacheDir), network, threads);

Please note I have yet to test this, we are thinking about pinning at the moment.

Good luck! Gav

References:

https://gist.github.com/JakeWharton/5616899 https://github.com/square/okhttp/blob/master/samples/guide/src/main/java/okhttp3/recipes/CertificatePinning.java

4
  • Thank you man, you solution saved me. I had to implement ssl pinning on android ver below 24 and we have two libraries in our app, Volley and Ksoap. I was getting no help from anywhere, even trustkit was not working. Then i came across your sol and took the HurlStack part. And pinning was available with volley in a jiffy. What i don't understand is this, i create a okhttp client, added a certificate pinner to it, then has this code mRequestQueue = Volley.newRequestQueue(context, new HurlStack(null, okClien.sslSocketFactory), the app ran smoothly but ssl pinning was nt working, do you know why?
    – beginner
    Commented Mar 20, 2020 at 11:41
  • 1
    When you create your instance of the Request Queue (mRequestQueue) you are passing it a new HurlStack and not your custom OKHttpStack. Try switching out the instantiation of the Request queue with something like mRequestQueue = Volley.newRequestQueue(context, new OKHttpStack(...)); Commented Mar 25, 2020 at 0:29
  • ok, didn't knew that we can instantiate a volley request with okhttpStack. Was limited by my knowledge in this section. We try this whenever i will face this kind of thing again. Thanks :)
    – beginner
    Commented Apr 1, 2020 at 9:00
  • okUrlFactory.open is not available now so the app crashes. Any solution for this? Commented Jul 2, 2021 at 7:03
1

You can use public key pinning instead of certificate pinning:

Public Key Pinning with Volley Library

1
  • The problem with HPKP is the app will be vulnerable the first time it connects to the webservice. If an attacker can do a MitM in that moment, client can be pinned with a wrong certificate for a very long time. This will not happen if you pin the connection using traditional certificate pinning.
    – arnau
    Commented Jan 13, 2017 at 9:03
0

I am implementing the same exact thing. I found a blog post that will hopefully be of help to you

http://ogrelab.ikratko.com/using-android-volley-with-self-signed-certificate/

2
  • I tried this but there is a problem. I download the sample code and just change the website url with "google.com" and it doesn't give any error connects to google.com and gets data. Did you see that? Commented Mar 24, 2015 at 9:12
  • I tried test certificate file and my own certificate but result is same. Commented Mar 24, 2015 at 9:26
0

You can use network_security_config.xml, more info : https://developer.android.com/training/articles/security-config

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.