compiletimeerror: Login application in Android with HTTPS / Android app to communicate with the server using HTTPS

Before developing our application, lets make our server application to support HTTPS. Here I am using tomcat server v7.0 and a simple web application with a servlet.

1. Making Tomcat Ready:

To make our tomcat to use HTTPS, follow below steps;

Create a keystore file using 'keytool' of your JDK which will be located in the bin folder of your JDK.
In my machine it is in L:\Program Files\Java\jdk1.6.0_23\bin

Open command prompt type below command

keytool -genkey -alias tomcat -keyalg RSA

It will ask for keystore password. Give any password ( I gave password )
Re-enter the same password when prompted.

It will ask for first name and last name.
Give the host name of your application.(I gave 192.168.1.3)
For example my server application URL is https://192.168.1.3:8443/LoginApp/login.do
So the host name here is 192.168.1.3 .

Note: I am going to use STRICT_HOSTNAME_VERIFIER in my android application which will check for the host name in the server certificate when connecting to a url.
If you dont want this, then any name for the first and last name and use ALLOW_ALL_HOSTNAME_VERIFIER in your android app.
You will get more idea when looking the android app code.

Give any values for other questions.

Finally the tool will ask you to enter the password for <tomcat> .
Just press ENTER to use the same password which we gave in the first step.
Note: <tomcat> is the alias name we gave in the command

Below is the screenshot of all these steps;

This will create a file called .keystore in your home directory. (In my macine it is L:\Users\Vienna)

We have created the keystore file and we need to use this in our tomcat. To do so, follow below steps

Goto your tomcat server installation path>conf folder. There you can see server.xml. Open this file in any editor.

Search for the tag <Service name="Catalina">. Inside this tag you can see a tag <Connector port="8443".
Initially this will be inside comment block .
Add below tag after the existing tag. ( I just want to keep the existing one untouched for future use)

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol" SSLEnabled="true"
maxThreads="150" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS"
keystoreFile="${user.home}/.keystore" keystorePass="password"
/>

Here ${user.home} is a predefined variable which is pointing to your home directory. You can use absolute path also.
keystorePass is the password which we gave in the keytool.

Finally server.xml will look like;

We are done, restart your tomcat.
You should see below message in the tomcat log. (Just for verification purpose)
INFO: Initializing ProtocolHandler ["http-nio-8443"]

2. Creating Server Application:

Now we need the server application to check the user name and the password. Here I have used a simple web application with a servlet. This application runs in a Tomcat server. You can have your own logic to validate the username and the password in the servlet. You can do database operations etc. But here I am just doing static validation of the username and password.

LoginServlet.java

/*
 * To change this template, choose Tools | Templates
 * and open the template in the editor.
 */
package serverside;

import java.io.IOException;
import java.io.PrintWriter;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

/**
 *
 * @author Vienna
 */
public class LoginServlet extends HttpServlet {

    /** 
     * Processes requests for both HTTP GET and POST methods.
     * @param request servlet request
     * @param response servlet response
     * @throws ServletException if a servlet-specific error occurs
     * @throws IOException if an I/O error occurs
     */
    protected void processRequest(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        response.setContentType("text/html;charset=UTF-8");
        PrintWriter out = response.getWriter();
        try {
        String un,pw;
        un=request.getParameter("username");
        pw=request.getParameter("password");
        if(un.equalsIgnoreCase("hello") &amp;&amp; pw.equals("world"))
            out.print(1);
        else
            out.print(0);
        } finally {            
            out.close();
        }
    }

    // HttpServlet methods.
    /** 
     * Handles the HTTP GET method.
     * @param request servlet request
     * @param response servlet response
     * @throws ServletException if a servlet-specific error occurs
     * @throws IOException if an I/O error occurs
     */
    @Override
    protected void doGet(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        processRequest(request, response);
    }

    /** 
     * Handles the HTTP POST method.
     * @param request servlet request
     * @param response servlet response
     * @throws ServletException if a servlet-specific error occurs
     * @throws IOException if an I/O error occurs
     */
    @Override
    protected void doPost(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        processRequest(request, response);
    }

    /** 
     * Returns a short description of the servlet.
     * @return a String containing servlet description
     */
    @Override
    public String getServletInfo() {
        return "Short description";
    }//
}

We are ready with the server application.

Now deploy your application in your tomcat and go to your browser and type https://192.168.1.3:8443/LoginApp/login.do

You should see below screen in your browser.

Note: I am using Internet Explorer

If you see this screen everything is ready with the server application.

3. Creating keystore.bks File:

We need openssl tool to make our android application use the server certificate and the Bouncy Castle Java cryptography APIs.

Download Bouncy Castle Java cryptography APIs from below url and extract the zip anywhere.

http://www.bouncycastle.org/latest_releases.html

Download openssl tool from below link and extract the zip anywhere.

http://code.google.com/p/openssl-for-windows/downloads/detail?name=openssl-0.9.8k_WIN32.zip

You can see the file openssl.exe inside the bin folder.

Now open command prompt. Go to this bin folder and type below command;

openssl s_client -connect 192.168.1.3:8443/LoginServer/>cert.pem

after seeing verify return:1 type exit and press ENTER

This command will create cert.pem inside the same folder.

This file will contain the certificate key information. We need to make a small editing in this file.

Open this cert.pem file in notepad, you can see something like

CONNECTED(00000070)

---

Certificate chain

0 s:/C=Unknown/ST=Unknown/L=Unknown/O=Unknown/OU=Unknown/CN=192.168.1.3

i:/C=Unknown/ST=Unknown/L=Unknown/O=Unknown/OU=Unknown/CN=192.168.1.3

---

Server certificate

-----BEGIN CERTIFICATE-----

MIICVzCCAcCgAwIBAgIEUO6RYjANBgkqhkiG9w0BAQUFADBwMRAwDgYDVQQGEwdV

bmtub3duMRAwDgYDVQQIEwdVbmtub3duMRAwDgYDVQQHEwdVbmtub3duMRAwDgYD

VQQKEwdVbmtub3duMRAwDgYDVQQLEwdVbmtub3duMRQwEgYDVQQDEwsxOTIuMTY4

LjEuMzAeFw0xMzAxMTAxMDAxMDZaFw0xMzA0MTAxMDAxMDZaMHAxEDAOBgNVBAYT

B1Vua25vd24xEDAOBgNVBAgTB1Vua25vd24xEDAOBgNVBAcTB1Vua25vd24xEDAO

BgNVBAoTB1Vua25vd24xEDAOBgNVBAsTB1Vua25vd24xFDASBgNVBAMTCzE5Mi4x

NjguMS4zMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCEYX+l5NQRFVK83Dyw

8Png099pr/JIKCutL0UgpgGI7nqmo9NJ2UQoLUF6DyogiHvR5kghOQRvID/FKLop

Ndj/RPUhEVvLkmo3SO4rJsEUfifC5BJWVFI0SU+PhdeMUfcrEyplJF3nzp9ckwUr

NgqTVkT+YsE3R0VW2JwjmWUtiQIDAQABMA0GCSqGSIb3DQEBBQUAA4GBAHOWnNsw

hxFPyqKBM/nEBq0hOGgCsaiMprve25rSpCtF5sOgZw0fGp7xe0y3DKdgyCBRtdDi

H3cXRV3et7eREPRc6w6wOp6PRoN3Bn/il7Xytx845Z5SZ2ADZlWhBBI7ohTMQrtp

M9jejbJFDO+oVjV/5pPm7cfIXhNSiL4lQIpY

-----END CERTIFICATE-----

subject=/C=Unknown/ST=Unknown/L=Unknown/O=Unknown/OU=Unknown/CN=192.168.1.3

issuer=/C=Unknown/ST=Unknown/L=Unknown/O=Unknown/OU=Unknown/CN=192.168.1.3

---

No client certificate CA names sent

---

SSL handshake has read 1183 bytes and written 290 bytes

---

New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA

Server public key is 1024 bit

Compression: NONE

Expansion: NONE

SSL-Session:

Protocol : TLSv1

Cipher : DHE-RSA-AES256-SHA

Session-ID: 50EE91DE7A499432BDB27D6F1C5E44AC3A56DB361A92787468140DA5F6DDE0F8

Session-ID-ctx:

Master-Key: E6651E06205BCBA552C58E543787CDD935D6E1A8CCDBC528000478419BE08FF93AC19392A8AFBCE101654ADECBC57623

Key-Arg : None

Start Time: 1357812190

Timeout : 300 (sec)

Verify return code: 18 (self signed certificate)

---

Remove the contents above -----BEGIN CERTIFICATE----- and below -----END CERTIFICATE----- and save the file. So finally cert.pem file will contain;