Self Signed Certificate in Android

Question

I am able to use Self-signed certificate, which I created using openssl.

The only problem I get while using the certificate in my HttpsURLConnection is of HostnameVerifier.

If I supply my own HostnameVerifier, which always return true like :

HostnameVerifier hostnameVerifier = new HostnameVerifier() {
        @Override
        public boolean verify(String hostname, SSLSession session) {
            return true;
        }
    };

in

urlConnection.setHostnameVerifier(hostnameVerifier);

it works.

Is there any way we can provide verification for our own host and not true for all ?

AND

Will HostnameVerifier work for local network (local IPs) also

Answer 1

Let's assume your server app is hosting inside a server machine which has a server certificate in which "Issued to" is "localhost", for example. Then, inside verify method you can verify "localhost".

HostnameVerifier hostnameVerifier = new HostnameVerifier() {
    @Override
    public boolean verify(String hostname, SSLSession session) {
        HostnameVerifier hv =
            HttpsURLConnection.getDefaultHostnameVerifier();
        return hv.verify("localhost", session);
    }
};