Android Question Help with https://

[schimanski]

Hello!

I want to use https to communicate between my server and the clients. I have made my own certificate and i had configured the server. If i post a file over the browser, the server redirects the http:// to https:// and everything runs fine. Now, i want to post and download files fom my clients over https with poststring, postfile, download and download2. What do i need to use these functions in my client? I have read everything about ssl, which i could found here, but this isn't clear for me. How has to be the code to initialize an https://-query? The same i want to do with the ios-client.. Is it possible?
Thanks for help....

 

[DonManfred]

See my Dropbox Class V2 HTTP
It is using SSL for all calls to Dropbox (It only works with ssl) using httputils (okHTTP)...

 

[schimanski]

I have read something about initializeacceptall. Is it not possible, to install my own private certificate on the clients without using acceptall? All clients are in a mdm, so it is no problem to install it remotly..

 

[schimanski]

ok. I have spend the hole day to solve the problem. I now made it with acceptAll...
For all, who want to try to install a private certificate: It doesn't runs: First, I made a .cer-file out of my keystore file with the keystoretool. After that, i have installed the certificate on an iphone 6+ and on my galaxy s6 edge with android 5.1.1. Under Android, the certificate is installed for "vpn and apps".
After that, i tried to communicate over https wirh my server without using acceptAll. But on both devices, the communication failed, because of the certificate...
For me, it was not possible to install my own cert and use it in my clients...

 

[schimanski]

At last, one question: Is it better to encrypt the server-password in the https://-query or is it not needed?

Thanks for help...

 

[Erel]

The data sent is encrypted as you are using https. However your connection is open to man in the middle attack because of the InitialzieAcceptAll.
If you are concerned about this attack then you should encrypt the data sent yourself.