wallabag / wallabag/android-app

Regarding the reasons why "Accept all SSL certificates" option was removed

Open
#532 11 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
587
Forks
276
PR merge metrics
No merged PRs in 30d

Description

This option was intentionally removed because it creates **a false sense of security**. At any given moment you're not able to tell if your connection is actually secure or it was tampered with.

Possible solutions:
* If you don't want to deal with certification authorities, you can import your self-signed certificate into your Android system.
* You can get a free SSL/TLS certificate (e. g. [Let's Encrypt](https://letsencrypt.org)) to take advantage of modern TLS security.
If you don't have a domain name yet, you might need to register it. Nowadays you can register a cheap (or maybe even free) domain name.
* If you have an SSL/TLS certificate, but you get `java.security.cert.CertPathValidatorException: Trust anchor for certification path not found` **and** you used the option to avoid the error, then **you should configure your server properly**. See #516.

Also, feel free to create a PR for #258 to implement a memorizing trust manager.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.