New SSL certificate verification method.

AndroidManifest.xml

 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
     package="cz.nic.datovka"
-    android:versionCode="15"
+    android:versionCode="16"
     android:versionName="1.1.1" >
 
     <uses-permission android:name="android.permission.INTERNET" >

src/cz/nic/datovka/tinyDB/DataBoxManager.java

@@ -34,10 +34,7 @@ import java.io.OutputStream;
 import java.net.ProtocolException;
 import java.net.URL;
 import java.security.KeyManagementException;
-import java.security.KeyStore;
-import java.security.KeyStoreException;
 import java.security.NoSuchAlgorithmException;
-import java.security.cert.CertificateException;
 import java.util.Arrays;
 import java.util.Date;
 import java.util.EnumSet;
@@ -57,6 +54,7 @@ import javax.xml.parsers.SAXParserFactory;
 import org.kobjects.base64.Base64;
 import org.xml.sax.SAXException;
 
+import android.content.res.Resources.NotFoundException;
 import cz.abclinuxu.datoveschranky.common.entities.Hash;
 import cz.abclinuxu.datoveschranky.common.entities.MessageEnvelope;
 import cz.abclinuxu.datoveschranky.common.entities.MessageState;
@@ -69,8 +67,6 @@ import cz.abclinuxu.datoveschranky.common.impl.DataBoxEnvironment;
 import cz.abclinuxu.datoveschranky.common.impl.DataBoxException;
 import cz.abclinuxu.datoveschranky.common.impl.Utils;
 import cz.abclinuxu.datoveschranky.common.interfaces.AttachmentStorer;
-import cz.nic.datovka.R.raw;
-import cz.nic.datovka.activities.AppUtils;
 import cz.nic.datovka.tinyDB.exceptions.DSException;
 import cz.nic.datovka.tinyDB.exceptions.HttpException;
 import cz.nic.datovka.tinyDB.exceptions.SSLCertificateException;
@@ -108,10 +104,8 @@ public class DataBoxManager {
 	
 	private static final int PRODUCTION = 0;
 	//private static final int TESTING = 1;
-	private int environment;
 
 	private DataBoxManager(int environment) {
-		this.environment = environment;
 		if(environment == PRODUCTION){
 			this.config = new Config(DataBoxEnvironment.PRODUCTION);
 		} else {
@@ -308,33 +302,18 @@ public class DataBoxManager {
 		authorization = "Basic " + new String(Base64.encode(userPassword.getBytes()));
 
 		try {
-			KeyStore keyStore = KeyStore.getInstance("BKS");
 			SSLContext sslcontext = SSLContext.getInstance("TLS");
 			
-			InputStream keyStoreStream;
-			if(environment == PRODUCTION){
-				keyStoreStream = AppUtils.ctx.getResources().openRawResource(raw.key_store_production_env);
-			} else {
-				keyStoreStream = AppUtils.ctx.getResources().openRawResource(raw.key_store_test_env);
-			}
-			keyStore.load(keyStoreStream, "kiasdhkjsdh@$@R%.S1257".toCharArray());
-			
-			sslcontext.init(null, new TrustManager[] { new MyAndroidTrustManager(keyStore) }, null);
+			sslcontext.init(null, new TrustManager[] { new MyAndroidTrustManager() }, null);
 			this.socketFactory = sslcontext.getSocketFactory();
 			
-		} catch (KeyStoreException e) {
-			e.printStackTrace();
-			throw new SSLCertificateException(e.getMessage());
 		}catch (NoSuchAlgorithmException e) {
 			e.printStackTrace();
 			throw new SSLCertificateException(e.getMessage());
-		} catch (CertificateException e) {
-			e.printStackTrace();
-			throw new SSLCertificateException(e.getMessage());
-		} catch (IOException e) {
+		} catch (KeyManagementException e) {
 			e.printStackTrace();
 			throw new SSLCertificateException(e.getMessage());
-		} catch (KeyManagementException e) {
+		} catch (NotFoundException e) {
 			e.printStackTrace();
 			throw new SSLCertificateException(e.getMessage());
 		}

src/cz/nic/datovka/tinyDB/MyAndroidTrustManager.java

 /*
- *  Datove schranky (http://github.com/b00lean/datoveschranky)
- *  Copyright (C) 2010  Karel Kyovsky <karel.kyovsky at apksoft.eu>
- *  Modification: 09/2012 CZ NIC z.s.p.o. <podpora at nic dot cz>
- *
- *  This file is part of Datove schranky (http://github.com/b00lean/datoveschranky).
- *
- *  Datove schranky is free software: you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation, either version 3 of the License
- *  
- *  Datove schranky is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with Datove schranky.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
+Datovka - An Android client for Datove schranky
+    Copyright (C) 2014  CZ NIC z.s.p.o. <podpora at nic dot cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
 package cz.nic.datovka.tinyDB;
 
+import java.io.IOException;
 import java.security.KeyStore;
 import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
 import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
 
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.TrustManagerFactory;
 import javax.net.ssl.X509TrustManager;
 
-public class MyAndroidTrustManager implements X509TrustManager {
-	private KeyStore ks;
+import android.content.res.Resources.NotFoundException;
+import android.util.Log;
+import cz.nic.datovka.R.raw;
+import cz.nic.datovka.activities.AppUtils;
 
-	public MyAndroidTrustManager(KeyStore ks) {
-		super();
-		this.ks = ks;
-	}
-
-	public void checkClientTrusted(X509Certificate[] cert, String authType) throws CertificateException {
-		//System.out.println("=============== checkClientTrusted " + cert + "  " + authType); //used just for debuging
+public class MyAndroidTrustManager implements X509TrustManager {
 
+	public void checkClientTrusted(X509Certificate[] cert, String authType)
+			throws CertificateException {
 	}
 
 	public void checkServerTrusted(X509Certificate[] certs, String authType) throws CertificateException {
-
-		//  Debug Code for saving certificates, used when www.mojedatovaschranka.cz changes certificates
-
-/*
-		try{
-		  KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
-			ks.load(null, null);
-			for (int i = 0; i < certs.length; i++) {
-				X509Certificate certificate = certs[i];
-				ks.setCertificateEntry(i + "", certificate);
+		
+		TrustManager[] tms = getTrustManagersFromBKS();
+		Log.i("Datovka", "Number of trust managers: " + tms.length);
+		
+		if(tms.length < 1)
+			throw new CertificateException("Empty BKS");
+		
+		try {
+			for (TrustManager tm : getTrustManagersFromBKS()) {
+				((X509TrustManager) tm).checkServerTrusted(certs, authType);
 			}
-			ByteArrayOutputStream bos = new ByteArrayOutputStream();
-			ks.store(bos, "kiasdhkjsdh@$@R%.S1257".toCharArray());
+		} catch (Exception e) {
+			e.printStackTrace();
+			throw new CertificateException(e.getMessage());
+		}
 
-			File root = Environment.getExternalStorageDirectory();
-			System.out.println(root.getAbsolutePath());
-			if (root.canWrite()) {
-				File file = new File(root, "key_store.ks");
-				FileOutputStream fos = new FileOutputStream(file);
-				fos.write(bos.toByteArray());
-				fos.close();
-			}
+		Log.i("Datovka", "Certificate verified");
+	}
+	
+	private TrustManager[] getTrustManagersFromBKS() {
+
+		try {
+			KeyStore keyStore = KeyStore.getInstance("BKS");
+			keyStore.load(AppUtils.ctx.getResources().openRawResource(raw.mytruststore), "secret".toCharArray());
+			return getTrustManagers(keyStore);
 		} catch (KeyStoreException e) {
 			e.printStackTrace();
 		} catch (NoSuchAlgorithmException e) {
 			e.printStackTrace();
+		} catch (CertificateException e) {
+			e.printStackTrace();
+		} catch (NotFoundException e) {
+			e.printStackTrace();
 		} catch (IOException e) {
 			e.printStackTrace();
 		}
-*/
-	
 		
-		//show me better solution how to trust someone on non-rooted android phone and i buy you a beer. 
-		int numberOfHits = 0;
-		for (int i = 0; i < certs.length; i++) {
-			X509Certificate cert = certs[i];
-			//System.out.println("IDN: " + cert.getIssuerDN());
-			//System.out.println("SDN: " + cert.getSubjectDN());
-			try {
-				String alias = ks.getCertificateAlias(cert);
-				//System.out.println("alias: " + alias);
-				if (alias != null) {
-					numberOfHits++;
-				}
-			} catch (KeyStoreException e) {
-				e.printStackTrace();
-			}
-		}
-		if (numberOfHits != certs.length) {
-			throw new CertificateException("Not trusting this server. Number of hits: " + numberOfHits + " Number of certs: " + certs.length);
+		return new TrustManager[0];
+	}
+	
+	private TrustManager[] getTrustManagers(KeyStore keystore) {
+		try {
+			TrustManagerFactory tmf =
+					TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
+			tmf.init((KeyStore) keystore);
+			return tmf.getTrustManagers();
+		} catch (NoSuchAlgorithmException e) {
+			e.printStackTrace();
+		} catch (KeyStoreException e) {
+			e.printStackTrace();
 		}
-		//System.out.println("=============== checkServerTrusted " + certs + "  " + authType);
-
+		
+		return new TrustManager[0];
 	}
 
 	public X509Certificate[] getAcceptedIssuers() {
-		//System.out.println("=============== getAcceptedIssuers");
 		return null;
 	}
 }
\ No newline at end of file