Retrofit handle the SSLHandshakeException

This blog focus on Retrofit handle the SSLHandshakeException.

Using Retrofit as your network library is a very good option for android app development. But many a time we face the SSLHandshakeException (java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.) to be particular.

This error means that the secure url you are making request to is not allowing your Retrofit to connect and fetch data.
If you can manage to change the usage from https to http then this will work perfectly fine and you don’t need to actually change anything.

But, if you can’t then you need to modify your retrofit Request builder object ( OkHttpClient.Builder to be particular) so that your application can fetch the data and the exception mentioned in the title is not a hurdle anymore.

Logical Approach

You need to modify your OkHttpClient.Builder object in your Retrofit request so that your request can actually create a certificate that can be trusted by your server and your server can allow the access to your request.

CODE

Modified OkHttpClient.Builder Object.

public static OkHttpClient.Builder getUnsafeOkHttpClient() {
        try {
            // Create a trust manager that does not validate certificate chains
            final TrustManager[] trustAllCerts = new TrustManager[]{
                    new X509TrustManager() {
                        @Override
                        public void checkClientTrusted(java.security.cert.X509Certificate[] chain, String authType) throws CertificateException {
                        }

                        @Override
                        public void checkServerTrusted(java.security.cert.X509Certificate[] chain, String authType) throws CertificateException {
                        }

                        @Override
                        public java.security.cert.X509Certificate[] getAcceptedIssuers() {
                            return new java.security.cert.X509Certificate[]{};
                        }
                    }
            };

            // Install the all-trusting trust manager
            final SSLContext sslContext = SSLContext.getInstance("SSL");
            sslContext.init(null, trustAllCerts, new java.security.SecureRandom());

            // Create an ssl socket factory with our all-trusting manager
            final SSLSocketFactory sslSocketFactory = sslContext.getSocketFactory();

            OkHttpClient.Builder builder = new OkHttpClient.Builder();
            builder.sslSocketFactory(sslSocketFactory, (X509TrustManager) trustAllCerts[0]);
            builder.hostnameVerifier(new HostnameVerifier() {
                @Override
                public boolean verify(String hostname, SSLSession session) {
                    return true;
                }
            });
            return builder;
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }

public static OkHttpClient.Builder getUnsafeOkHttpClient() {

try {

// Create a trust manager that does not validate certificate chains

final TrustManager[] trustAllCerts = new TrustManager[]{

new X509TrustManager() {

@Override

public void checkClientTrusted(java.security.cert.X509Certificate[] chain, String authType) throws CertificateException {

}

@Override

public void checkServerTrusted(java.security.cert.X509Certificate[] chain, String authType) throws CertificateException {

}

@Override

public java.security.cert.X509Certificate[] getAcceptedIssuers() {

return new java.security.cert.X509Certificate[]{};

}

};

// Install the all-trusting trust manager

final SSLContext sslContext = SSLContext.getInstance("SSL");

sslContext.init(null, trustAllCerts, new java.security.SecureRandom());

// Create an ssl socket factory with our all-trusting manager

final SSLSocketFactory sslSocketFactory = sslContext.getSocketFactory();

OkHttpClient.Builder builder = new OkHttpClient.Builder();

builder.sslSocketFactory(sslSocketFactory, (X509TrustManager) trustAllCerts[0]);

builder.hostnameVerifier(new HostnameVerifier() {

@Override

public boolean verify(String hostname, SSLSession session) {

return true;

}

});

return builder;

} catch (Exception e) {

throw new RuntimeException(e);

}

using this object in your retrofit request.

Retrofit retrofit = new Retrofit.Builder()
            .baseUrl(YOUR_BASE_URL)
            .client(getUnsafeOkHttpClient().build())
            .build();

Retrofit retrofit = new Retrofit.Builder()

.baseUrl(YOUR_BASE_URL)

.client(getUnsafeOkHttpClient().build())

.build();

That’s All.

Keep coding and Keep Sharing.

anchit 14 December 2017

. . .

20 comments

อุรคินทร์ เต็มรัตน์ Oct 7, 2019 at 3:12 pm

Thank you.

anchit (Moderator) Oct 7, 2019 at 3:13 pm
You are welcome 🙂

Reply

Qudratilla Nov 21, 2019 at 7:05 pm

Thanks a lot helped

anchit (Moderator) Nov 26, 2019 at 11:32 am
Your welcome 🙂

Reply

Mohana Apr 27, 2020 at 1:05 pm

Thank you so much

MOHAMED ABO SAGED Jul 6, 2020 at 10:20 am

thanks ….. but now statusCode: 400 !!! what is the solution

Bill Crandell Aug 12, 2020 at 12:59 am

Holly crap you saved me a $2500 loss thank you 50 tablets I needed to work and this made it happen thank you very much…I’ll ask the man to send a few bucks

anchit (Moderator) Dec 29, 2020 at 5:13 pm
Thanks

It is good to hear that our blog helped you.
It means a lot.

Reply

Bill Crandell Aug 12, 2020 at 1:00 am

I dont see a donate option for you…

anchit (Moderator) Dec 29, 2020 at 5:15 pm
Thanks for your appreciation.

But we don’t accept donations for technical blogs.
These blogs are one of the efforts from our side to make the mobile development community better.

Reply

Nicodemus Ojwee Jan 30, 2021 at 12:20 am

The only solution that worked after 2 days. Thank you so much.

anchit (Moderator) Jan 30, 2021 at 5:44 pm
Your welcome 🙂

Reply

Deepak Feb 25, 2021 at 3:53 am

Thank you so much. You got an awesome blog. Keep up the good work.

anchit (Moderator) Oct 9, 2021 at 8:56 pm

Your Welcome

Reply

Feryal Oct 4, 2021 at 1:28 pm

This solution is great and works fine but the images inside the API doesn’t work, the images also with URL that starts with https, what could be the problem?

anchit (Moderator) Oct 9, 2021 at 10:16 pm

Hi,

Thanks for your appreciating words.

The images are perhaps not working becuase you might be using some different library to load the images.

If this is the case, then please do consider adding something similar for the image library as well.

If you are not using any library to load the images from a url, then please do let me know how are you loading the images so that i can suggest something.

Reply

Cristhian Ruiz Dec 2, 2021 at 10:22 am

Muchas gracias, en verdad me ayudo mucho.

anchit (Moderator) Dec 4, 2021 at 6:02 pm

Gracias por tus amables palabras

Consulte también nuestros otros blogs

Reply

Ivan Jan 30, 2023 at 3:08 pm

Ты просто красавчик. Спасибо. Реально помогло. Испытал кучу вариантов, но это единственный, что решил проблему.

You’re just attaboy. Thanks. It really helped. I’ve tried a bunch of options, but this is the only one that solved the problem.

anchit (Moderator) Mar 18, 2023 at 8:58 pm

Добро пожаловать

Your Welcome

Reply

Retrofit handle the SSLHandshakeException

Logical Approach

CODE

Leave a Comment Cancel Reply

20 comments

Message Sent!