javax.net.ssl.sslpeerunverifiedexception no peer certificate Error In lifelogApi

Question

We are getting SSL peer unverified error while fetching the access token from Lifelog api. I am able to get the authcode, but when i am trying to get access token, it is giving me SSL peer error. It works fine with few device, but most of the device it is giving SSL error.

private void getAccessToken(final String authCode)
{
final String finalUrl = String.format("https://platform.lifelog.sonymobile.com/oauth/2/token?client_id=%s&client_secret=%s&code=%s",CLIENT_ID,CLIENT_SECRET,authCode);
    Thread networkThread = new Thread(new Runnable() {
        public void run() {
            try {
                HttpClient client = new DefaultHttpClient();
                HttpPost post = new HttpPost(finalUrl);
                // Add your data
                ArrayList<NameValuePair> nameValuePairs = new ArrayList<NameValuePair>(4);
                nameValuePairs.add(new BasicNameValuePair("client_id", CLIENT_ID));
                nameValuePairs.add(new BasicNameValuePair("client_secret", CLIENT_SECRET));
                nameValuePairs.add(new BasicNameValuePair("grant_type", "authorization_code"));
                nameValuePairs.add(new BasicNameValuePair("code", authCode));
                AbstractHttpEntity ent=new UrlEncodedFormEntity(nameValuePairs, HTTP.UTF_8);
                ent.setContentType("application/x-www-form-urlencoded; charset=UTF-8");
                post.setEntity(ent);
                // Execute HTTP Post Request
                HttpResponse response =null;
                try {
                    response = client.execute(post);
                    Log.d("Response:" , response.toString());
                } catch (IOException e) {
                    e.printStackTrace();
                }
                String dataObject =  response.toString();
                JSONObject obj;
                if(dataObject != null) {
                    obj = null;

                    try {

                        String json_string = EntityUtils.toString(response.getEntity());
                        //     displayToast(json_string);
                        obj = new JSONObject(json_string);
                        SharedPreferences prefs =getSharedPreferences("Myprefs", Context.MODE_PRIVATE);

                        prefs.edit().putString("Access_token", obj.getString("access_token"));

//                            prefs.edit().putString(AUTH_REFRESH_TOKEN, obj.getString(AUTH_REFRESH_TOKEN));

                    } catch (JSONException e) {
                        e.printStackTrace();
                    }
                }
            }  catch (IOException e) {
                // TODO Auto-generated catch block
            }
        }
    });
    networkThread.start();   }

Answer 1

The problem may be with your use of HttpClient. It looks like Google has removed support for this call in Android 6.0.

http://developer.android.com/about/versions/marshmallow/android-6.0-changes.html#behavior-apache-http-client

You should be able to use HttpsURLConnection instead of Httpclient to access the Lifelog Web Service.

Answer 2

I'm using google-oauth-client, I was able to use on Android 5.x with this initialization for

import com.google.api.client.http.HttpTransport;

private void initializeSocketFactory() {
    if (Build.VERSION.SDK_INT >= 23) {
        HTTP_TRANSPORT = new NetHttpTransport();
    } else {
        //Android 5 and bellow needs this SSL Socket factory initialization
        try {
            SSLContext sslContext = SSLContext.getInstance("TLSv1");
            sslContext.init(null, null, null);
            SSLSocketFactory socketFactory = sslContext.getSocketFactory();
            NetHttpTransport.Builder netTransportBuilder = new NetHttpTransport.Builder();
            netTransportBuilder.setSslSocketFactory(socketFactory);
            HTTP_TRANSPORT = netTransportBuilder.build();
        } catch (NoSuchAlgorithmException | KeyManagementException e) {
            Log.e(LOG_TAG, "Problem instantiating cipher for ssl socket", e);
        }
    }

}

You use HTTP_TRANSPORT to instantiate:

import com.google.api.client.auth.oauth2.AuthorizationCodeFlow;