wallabag / wallabag/android-app
Regarding the reasons why "Accept all SSL certificates" option was removed
- Dominant language
- Java
- Stars
- 587
- Forks
- 276
- PR merge metrics
- No merged PRs in 30d
Description
This option was intentionally removed because it creates **a false sense of security**. At any given moment you're not able to tell if your connection is actually secure or it was tampered with.
Possible solutions:
* If you don't want to deal with certification authorities, you can import your self-signed certificate into your Android system.
* You can get a free SSL/TLS certificate (e. g. [Let's Encrypt](https://letsencrypt.org)) to take advantage of modern TLS security.
If you don't have a domain name yet, you might need to register it. Nowadays you can register a cheap (or maybe even free) domain name.
* If you have an SSL/TLS certificate, but you get `java.security.cert.CertPathValidatorException: Trust anchor for certification path not found` **and** you used the option to avoid the error, then **you should configure your server properly**. See #516.
Also, feel free to create a PR for #258 to implement a memorizing trust manager.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.