Re: HTTP GET with SSL and Self-Signed Certificates

[Pent]

> errors? I tried adding the certificate to the built-in trusted store in
> Jelly Bean, but that didn't seem to do anything. Even the browser still
> threw an error so I'm guessing the trust store only works for WiFi/VPN
> certs.

Did you reboot after that ?

Pent

[Ryan]

Yeah, I did try to reboot, and unfortunately it didn't make a difference.

[Pent]

> Yeah, I did try to reboot, and unfortunately it didn't make a difference.

I'll add a parameter after the next release.

Pent

[Vladimir Oz]

+100500 support for HTTP digest auth
 

[Pent]

Regards the OP problem: thinking about this further, what's the point
of using HTTPS if you're going to ignore certificate errors ?

Pent

[Scott Miller]

> Regards the OP problem: thinking about this further, what's the point
> of using HTTPS if you're going to ignore certificate errors ?

I can think of a few reasons. If the root CA is trusted by the user, but the root cert is not installed on the device, the encryption is still valid, but an error would occur. The same holds true if the cert is expired, or if it is a self signed cert. Certainly it increases the risk, but if the user is comfortable with those risks, it's still better to use https instead of http.

[Pent]

Right, true.

Looking at the code, it's not as trivial to implement as I had
expected and so won't be in a coming-soon release, sorry.

However, it remains at higher-than-most-other-things priority.

Pent

[Ryan]

Thanks for the update Pent. I'm using this for my home automation system, and so I want the password to be encrypted. Interestingly I just saw a post from someone using the same system as me, but they seem to be fine using HTTP despite the fact that their username/password could easily be sniffed out:

https://groups.google.com/d/topic/tasker/Xc6uzebi3sM/discussion

It sounds like the developer of one of the popular apps to manage the home automation system is looking to add Tasker integration, which would solve this issue.

http://forum.mobilinc.com/viewtopic.php?f=47&t=2164&sid=2fb49b5b8711dffafcbfdaf23780362b&start=10#p4546

[Chris Lawrence]

Hi All,

I am doing just exactly this without any issue.  I use the 3rd party HTTP GET plugin for tasker rather than the built-in, and it works great with my self-signed cert.  It is a home-grown web interface to interact with my windows based HA system (Home Control Assistant, best bang for the buck option IMHO :)).  

Anyways, the web interface sits behind Apache with a self-signed cert, embedding the user:pass@ in the URL with the plugin works fine.

On Wednesday, August 8, 2012 12:19:12 AM UTC-5, Ryan wrote:

I love this app, and I was trying to configure an HTTP GET action using SSL and noticed that it doesn't play too nice with self-signed/untrusted certificates. This is the error I get:

"Input/Output error for https://example.com/blah: javax.net.ssl.SSLHandshakeException: java.security.cert. CertPathValidatorException: Trust anchor for certification path not found..."

I'm using a self-signed certificate so I wasn't all that surprised to see the error, but was hoping that maybe you could add an option to the HTTP GET (and probably HTTP POST, too) to be able to ignore any certificate errors? I tried adding the certificate to the built-in trusted store in Jelly Bean, but that didn't seem to do anything. Even the browser still threw an error so I'm guessing the trust store only works for WiFi/VPN certs.

I'm using the latest Beta so I'm open to test out any changes if you consider incorporating this.

[Ryan]

I'd be curious to know what plugin you are using. I ended up taking a different approach. I downloaded cURL for Android, and then set Tasker to run a shell script like this:

curl https://example.com/test --insecure

The key here is the "--insecure" flag which tells cURL to ignore the SSL certificate warning.

[Chris Lawrence]

Apologies for not being more specific, I was in a rush walking out the door to lunch while at work when I posted that, wasn't thinking clearly. :)

The plugin has changed its name a few times I think, I recall it being called "HTTP POST", but its now called "HTTP Poster and Locale Plugin" - however once installed, inside Tasker's plugin section, its called "HTTP Post" still.

URL to the play store link is: https://play.google.com/store/apps/details?id=com.steelgirder.LocaleSendEmailPlugin#?t=W251bGwsMSwxLDIxMiwiY29tLnN0ZWVsZ2lyZGVyLkxvY2FsZVNlbmRFbWFpbFBsdWdpbiJd

Again, seems to do the trick for me with self-signed certs.  I've been using it since I started using Tasker (about a year ago) without incident.  I actually *like* how you did it better as I'm a sysadmin by trade (so it appeals to the nerd in me ;)), but if you're interested in making a built-in plugin with a GUI work for you, try HTTP Post, it seems to work for me.  Heck just try and get a test done within the 15 minutes you can always get a refund if it doesn't do what you're trying to do.

[Wietse van Buitenen]

didn't know there's finally a binary of cURL out for Android, been looking for this over a year ago and then it wasn't available..

thanks for the link :)

[Ivaylo Kalatchev]

Chris - thanks for the tip!

I was having the same trouble with the self-signed certificate doing HTTP Post inside Tasker and the "HTTP Poster and Locale Plugin" plugin solved the problem!

[Paul]

Did anyone get this to work for https get? I get a successful toast message using the HTTP Poster plugin but I got no way to retrieve the data? Is it stored in some variable I am missing?

Op woensdag 8 augustus 2012 07:19:12 UTC+2 schreef Ryan:

[Pent]

Addressing the OP: I've added a parameter to HTTP Get/Post for the next version to ignore Anchor errors.

At the moment I'm just catching the exception and continuing. It could be I'll need to do something a bit deeper,
let me know if it works. Probably you'll get a different exception.

Pent

[Keith Lawrence]

Would love to have this feature so that I can connect to my trusted but uncertified home automation system - can't see it in the latest version though, did it go out with the previous update?

(Have also tried the HTTP Poster and Locale plug-in, but it doesn't seem to skip the unknown cert errors either)

Cheers,

Keith

[Pent]

I expect to publish it in a few days.

Pent