<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Hello Viktor,</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-size: 12pt;"><span style="color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif;">Thanks for your reply. The reason that I am trying to use the OpenSSL instead of using a library like Volley on Android is: The original environment
of the project is in a private network. Our network provider shells all threats for us. So our app is installed on devices that are only required unsecured connections between devices and servers. </span><font color="#000000" face="Calibri, Helvetica, sans-serif">Now
we need some features from the original firmware for a new android app. The app users are going to use the internet. So the secured connections are required. If we can use OpenSSL to handle handshake and certificate verification the same code can be reused
on firmware and potentially allowing our devices to use the internet in the future.</font></div>
<div style="font-size: 12pt;"><font color="#000000" face="Calibri, Helvetica, sans-serif"><br>
</font></div>
<div style="font-size: 12pt;"><font color="#000000" face="Calibri, Helvetica, sans-serif">> Almost certainly, but your question is rather oddly phrased and notcompletely clear. PEM files don't establish connections.<br>
</font></div>
<div style="font-size: 12pt;"><font color="#000000" face="Calibri, Helvetica, sans-serif">Instead of using all certs in the trust store, I was trying to use as few cert files as possible. And you are right PEM files do not establish connections. I need cert
file to verify the server's certs before establishing connections.</font></div>
<div style="font-size: 12pt;"><font color="#000000" face="Calibri, Helvetica, sans-serif"><br>
</font></div>
<div style="font-size: 12pt;"><font color="#000000" face="Calibri, Helvetica, sans-serif">Currently, I know the URL of our web service. I created a client then I tried to copy some certs from the Ubuntu trust store. Found the cert `09789157.0` is able to verify
our test servers' certs. Then, I copied the text from the file 09789157.0, hard-coded the content of the file in the code, created an X509 object based on the text, and using `X509_STORE_add_cert` to add the cert to a store in a SSL_CTX. It works on Android.
But I am thinking I might just do what you mentioned:</font></div>
<div style="font-size: 12pt;"><font color="#000000" face="Calibri, Helvetica, sans-serif">"If you just extract the certificates, without the
<div>associated trust settings, you may well end up undermining some of the</div>
<div>expected security properties, because some restricted use certificates</div>
may then lose their associated restrictions."</font></div>
<div style="font-size: 12pt;"><font color="#000000" face="Calibri, Helvetica, sans-serif"><br>
</font></div>
<div style="font-size: 12pt;"><font color="#000000" face="Calibri, Helvetica, sans-serif">So, my question is what should I do to find out the "associated trust settings" and include those settings? </font></div>
<div style="font-size: 12pt;"><font color="#000000" face="Calibri, Helvetica, sans-serif"><br>
</font></div>
<div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div id="Signature">
<div>
<div style=""><font color="#000066"><font face="Verdana, Geneva, Arial, Sans-serif"><font size="2">Thanks for your help</font></font></font></div>
<div style=""><font color="#000066"><font face="Verdana, Geneva, Arial, Sans-serif"><font size="2"><br>
</font></font></font><font color="#000066"><font face="Verdana, Geneva, Arial, Sans-serif">r0nG</font></font></div>
<div style=""><font color="#000066"><font face="Verdana, Geneva, Arial, Sans-serif"><br>
Auckland, New Zealand</font></font></div>
</div>
</div>
</div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>发件人:</b> openssl-users <openssl-users-bounces@openssl.org> 代表 Viktor Dukhovni <openssl-users@dukhovni.org><br>
<b>发送时间:</b> 2021年3月3日 5:34<br>
<b>收件人:</b> openssl-users@openssl.org <openssl-users@openssl.org><br>
<b>主题:</b> Re: Question: How to using cert files on Android platform?</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText">On Wed, Mar 03, 2021 at 01:56:31AM +0000, Yang Rong wrote:<br>
<br>
> I am new to OpenSSL. I am working on a project using JNI+ OpenSSL on<br>
> an Android App.<br>
<br>
Can you briefly explain your motivation for using OpenSSL via JNI,<br>
rather than just use the native android TLS APIs, which then just use<br>
the Android trust store?<br>
<br>
> The OpenSSL is not able to use certs in the Android trust store.<br>
<br>
The Android trust store is likely more fine-grained than you'd naively<br>
expect. Not all the trusted certificates are necessarily trusted for<br>
the same purposes. If you just extract the certificates, without the<br>
associated trust settings, you may well end up undermining some of the<br>
expected security properties, because some restricted use certificates<br>
may then lose their associated restrictions.<br>
<br>
> Do we have a way to use the Android trust store in 2021?<br>
<br>
The simplest and generally most appropriate answer is: via the Android<br>
APIs, and without JNI into OpenSSL.<br>
<br>
If you have a compelling reason to use OpenSSL, you'll probably need<br>
to provision a dedicated trust store of known to be appropriate trust<br>
anchors.<br>
<br>
> The target API level of the Android App is 28. If OpenSSL is<br>
> still not able to use the Android default trust stores nowadays. I<br>
> would like to copy the certs from Ubuntu to the Android app.<br>
<br>
If it is appropriate to trust the same root CAs (something probably<br>
along the lines of the Mozilla cert bundle), then you could do that,<br>
but why is this necessary?<br>
<br>
> But I need to figure out which pem file is used to establish<br>
> connections.<br>
<br>
Now it seems that you're not well versed in OpenSSL, which strongly<br>
suggests that it is really best to stick to the provided APIs, and<br>
not roll your own security toolkit.<br>
<br>
> Is there a way any OpenSSL command line cmd is able to do<br>
> that?<br>
<br>
Almost certainly, but your question is rather oddly phrased and not<br>
completely clear. PEM files don't establish connections.<br>
<br>
Are you looking to capture the entire Ubuntu trust store, or just<br>
the specific trust-anchor that is *currently* the ultimate issuer<br>
of the server's certificate chain? Do you have good reason to<br>
believe that the server will continue to use the same root CAs<br>
indefinitely? ...<br>
<br>
If your reasons for not using the Android APIs are not absolutely<br>
compelling, your best bet is to use those, despite whatever non-critical<br>
disadvantages are driving you to consider OpenSSL instead.<br>
<br>
-- <br>
Viktor.<br>
</div>
</span></font></div>
</div>
</body>
</html>