Android Question SSL - how do I configure my B4A client app to connect to my B4J server?

[Dave O]

I think I've got my B4J server converted to SSL. On the B4a client end, what do I need to do (other than changing the target prefix to "https://"?

Long version:
I've been testing a B4A client app that uses CloudKVS to sync with a B4J server app running on an Ubuntu VPS. That all works pretty well so far.

I'd like to secure the network traffic using SSL, so I got a domain name and SSL certificate for the VPS. Using the posts on this forum, I think I've got it configured OK on the server side (he said hopefully).

On the B4A side, I'm not sure what I need to do, other than the obvious:
- Change the URL prefix from http to https.
- Remove the clear-text entry in the manifest.

I suspect I need to include the keystore somehow, but not sure of the specifics. I found a B4A library for doing SSL, but wasn't sure if that was needed for basic SSL support.

Any tips appreciated!

 

[Erel]

The main question - are you using a valid certificate, and not a self signed certificate? If so then you don't need to do anything special.

If this is a self signed certificate then it is highly recommended to use a service such as LetsEncrypt to create a valid certificate.

 

[Dave O]

I considered starting with a self-signed cert, but there were enough cautions on that to make me decide to get a free 90-day cert from ZeroSSL.

I'll give it a go tomorrow. Thanks!

 

[Dave O]

If I don't need the key/keystore on the client app, does that mean that anyone can send requests to my SSL-ed VPS?

I assumed that the security was two-way - the client and server would each need to prove that they were using the same key. (Sorry, I don't know much about SSL or public/private keys yet.)

Is it advisable to restrict server requests to just my client app? If so, what should I read up on?

Thanks again!

 

[Erel]

If I don't need the key/keystore on the client app, does that mean that anyone can send requests to my SSL-ed VPS?

Yes.

There is really no way to make the server only accessible from your app, without a separate and user specific authentication process. You can create an account for each user and let the user enter their password (or use FirebaseAuth as an alternative). More information is needed to provide concrete suggestions.

 

[Dave O]

Thanks, I will investigate options for authentication. (I'm already checking the security of each request to make sure that the user (identified by their email) has access to the data they're trying to read/write, but I'd like to go further and make sure the server is only accepting requests from my client apps).

I have some questions on this too, but I'll start a separate thread for that.

Thanks!