Android: oauth.signpost.exception.OAuthCommunicati

I've been trying to learn how to authenticate an android app to a server using oAuth 1.0a (I know it's out of date, but it's what I'm being forced to use.), and I've been following the tutorial on how to connect an application to oAuth1.0a here

However, after writing the activity that they suggest, i've been encountering an error like the following:

oauth.signpost.exception.OAuthCommunicationException: Communication with the service provider failed: No peer certificate
        at oauth.signpost.AbstractOAuthProvider.retrieveToken(AbstractOAuthProvider.java:218)
        at oauth.signpost.AbstractOAuthProvider.retrieveRequestToken(AbstractOAuthProvider.java:74)
        at com.company.companyone.account.PrepareRequestTokenActivity$OAuthRequestTokenTask.doInBackground(PrepareRequestTokenActivity.java:141)
        at com.company.companyone.account.PrepareRequestTokenActivity$OAuthRequestTokenTask.doInBackground(PrepareRequestTokenActivity.java:122)
        at android.os.AsyncTask$2.call(AsyncTask.java:287)
        at java.util.concurrent.FutureTask.run(FutureTask.java:234)
        at android.os.AsyncTask$SerialExecutor$1.run(AsyncTask.java:230)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1080)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:573)
        at java.lang.Thread.run(Thread.java:856)

Caused by: javax.net.ssl.SSLPeerUnverifiedException: No peer certificate

The activity that I've written is as follows:

public class PrepareRequestTokenActivity extends Activity {

private CommonsHttpOAuthConsumer consumer;
private CommonsHttpOAuthProvider provider;
private final static String TAG = "PrepareRequestTokenActivity";

@Override
protected void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    setContentView(R.layout.activity_prepare_request_token);
    try {

        System.setProperty("debug", "true");

        consumer = new CommonsHttpOAuthConsumer(Constants.CONSUMER_KEY, Constants.CONSUMER_SECRET);



        provider = new CommonsHttpOAuthProvider(
                Constants.REQUEST_URL,
                Constants.ACCESS_URL,
                Constants.AUTHORIZE_URL);



        provider.setOAuth10a(true);

    } catch (Exception e) {

        Log.d(TAG, "Error intializing consumer and provider", e);
        e.printStackTrace();

    }


    Log.i(TAG, "Starting task to retrieve request token.");

    new OAuthRequestTokenTask(this,consumer,provider).execute();

}

@Override
protected void onResume(){
    super.onResume();
    //need to get the preferences to store response tokens later.
    SharedPreferences prefs = PreferenceManager.getDefaultSharedPreferences(this);
    final Uri uri = getIntent().getData();

    //make sure that the callback worked correctly
    if(uri != null && uri.getScheme().equals(Constants.OAUTH_CALLBACK_SCHEME)){
        Log.i(TAG, "Got Callback : uri = " +uri);
        Log.i(TAG, "Attempting to Retrieve Access Token");

        new RetrieveAccessTokenTask(this,consumer,provider,prefs).execute(uri);
        //done
        finish();
    }else{
        Log.d(TAG, "Fatal Error: oAuth Callback malformed.");
    }


}


@Override
public boolean onCreateOptionsMenu(Menu menu) {
    // Inflate the menu; this adds items to the action bar if it is present.
    getMenuInflater().inflate(R.menu.menu_prepare_request_token, menu);
    return true;
}

@Override
public boolean onOptionsItemSelected(MenuItem item) {
    // Handle action bar item clicks here. The action bar will
    // automatically handle clicks on the Home/Up button, so long
    // as you specify a parent activity in AndroidManifest.xml.
    int id = item.getItemId();

    //noinspection SimplifiableIfStatement
    if (id == R.id.action_settings) {
        return true;
    }

    return super.onOptionsItemSelected(item);
}

private class OAuthRequestTokenTask extends AsyncTask<String, Void, String>{

    private CommonsHttpOAuthConsumer reqConsumer;
    private CommonsHttpOAuthProvider reqProvider;
    private Context context;

    public OAuthRequestTokenTask(PrepareRequestTokenActivity prepareRequestTokenActivity, CommonsHttpOAuthConsumer reqConsumer, CommonsHttpOAuthProvider reqProvider){
        this.context = prepareRequestTokenActivity.getApplicationContext();
        this.reqConsumer = reqConsumer;
        this.reqProvider = reqProvider;



    }

    @Override
    protected String doInBackground(String... strings) {
        try {
            Log.i(TAG, "Retrieving request token from Magento servers");

            final String url = reqProvider.retrieveRequestToken(reqConsumer, Constants.OAUTH_CALLBACK_URL);
            Log.i(TAG, "Popping a browser with the authorize URL : " + url);
            Intent intent = new Intent(Intent.ACTION_VIEW, Uri.parse(url)).setFlags(Intent.FLAG_ACTIVITY_SINGLE_TOP | Intent.FLAG_ACTIVITY_NO_HISTORY | Intent.FLAG_FROM_BACKGROUND);
            context.startActivity(intent);

        } catch (Exception e) {
            Log.e(TAG, "Error during OAUth retrieve request token", e);
            e.printStackTrace();
        }
        return null;
    }
}

private class RetrieveAccessTokenTask extends AsyncTask<Uri, Void, Void> {

    private Context context;
    private CommonsHttpOAuthConsumer consumer;
    private CommonsHttpOAuthProvider provider;
    private SharedPreferences prefs;

    //collect the instance variables for the Access Token request
    public RetrieveAccessTokenTask(PrepareRequestTokenActivity prepareRequestTokenActivity, CommonsHttpOAuthConsumer consumer, CommonsHttpOAuthProvider provider, SharedPreferences prefs) {
        this.context = prepareRequestTokenActivity.getApplicationContext();
        this.consumer = consumer;
        this.provider = provider;
        this.prefs = prefs;
    }


    //called by .execute()
    //takes Verifier Token and uses it to retrieve the Access Token by validating this instance of the app.
    @Override
    protected Void doInBackground(Uri... params) {
        final Uri oauth_uri = params[0];

        final String verifier = oauth_uri.getQueryParameter(OAuth.OAUTH_VERIFIER);

        try{
            //set the provider to do it's ish.
            provider.retrieveAccessToken(consumer,verifier);

            //save the token in the shared preferences so that we can use it in our request methods.
            //MAKE SURE YOU LEAVE THIS AS COMMIT. We want this to persist in memory, and apply doesn't guarantee that the token will remain if the app closes immediately.
            final SharedPreferences.Editor edit = prefs.edit();
            edit.putString(OAuth.OAUTH_TOKEN, consumer.getToken());
            edit.putString(OAuth.OAUTH_TOKEN_SECRET, consumer.getTokenSecret());
            edit.commit();

            String token = prefs.getString(OAuth.OAUTH_TOKEN,"");
            String secret = prefs.getString(OAuth.OAUTH_TOKEN_SECRET,"");

            consumer.setTokenWithSecret(token,secret);

            Toast.makeText(context, "Token Success! += "+ token, Toast.LENGTH_LONG);


            //kick it back to the mainactivity.
            context.startActivity(new Intent(context, MainActivity.class));

        } catch (Exception e) {
            e.printStackTrace();
        }
        return null;
    }
}

}

I'm not certain if the error that I have is caused by a bad SSL certificate from the VM that I'm running the Magento webserver on, or if the error is somewhere in my code. The SSL Certificate is self-signed if that helps so that it can be tested over a private network.

//oAuth Constants
public static final String REQUEST_URL="https://myhost/oauth/initiate";
public static final String ACCESS_URL="https://myhost/oauth/token";
public static final String AUTHORIZE_URL="https://myhost/oauth/authorize ";

This is the line that throws the error.

final String url = reqProvider.retrieveRequestToken(reqConsumer, Constants.OAUTH_CALLBACK_URL);

I traced the error to the CommonsHttpOAuthProvider.sendRequest() method. It breaks at:

HttpResponse response = httpClient.execute((HttpUriRequest) request.unwrap());

Before the request.unwrap() call is executed.

TL;DR: Did I do something wrong, and does Android just not like self-signed SSL certificates?

Short Answer: Yes, the SSL certificate is causing the problem. Solution for self-signed and out-of-order certificates below.

NOTE: I'm pretty sure this doesn't take away from security, but I'm also not sure if the order of the SSL certificates is super important. So take this with a grain of salt. I definitely plan on taking this out once the live environment is up and running, so I wouldn't recommend keeping this code in your app unless your environment is completely controlled and all hosts that you will be connecting to are known.

Step 1: Out of order certificates. Need to define a custom TrustManager that will handle bad certificates for you. (I found a reference to this solution online somwhere, but I can't find the link now).

/**
 * Created by Nevuroth on 1/19/15.
 */
public class CustomX509TrustManager implements X509TrustManager{

private X509TrustManager defaultManager = null;

/**
 * Custom constructor for the x509 trust manager. This workaround won't take away from security, but it will drop and accept the self signed cert for our test server at the
 * end of the cert chain, as well as allowing
 *
 * @param keyStore
 * @throws NoSuchAlgorithmException
 * @throws KeyStoreException
 */
public CustomX509TrustManager(KeyStore keyStore) throws NoSuchAlgorithmException, KeyStoreException{
    super();
    TrustManagerFactory factory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
    factory.init(keyStore);
    TrustManager[] trustManagers = factory.getTrustManagers();
    if(trustManagers.length ==0){
        throw new NoSuchAlgorithmException("Failed to find Default trust managers");
    }

    this.defaultManager = (X509TrustManager) trustManagers[0];

}


//we just want the standard functionality for x509
@Override
public void checkClientTrusted(X509Certificate[] x509Certificates, String s) throws CertificateException {
    defaultManager.checkClientTrusted(x509Certificates, s);
}

/**
 *  Here's where the magic happens, we're going to be compensating for out of order certificates in the X509 header
 *  as well as compensating for self-signed certificates (kind of), by passing the certificate before it in the chain
 *  to the chekc servertrusted method
 *  This won't compensate for purely self-signed certs.... but you can do so by adding it to the accepted issuers method.
 * @param x509Certificates
 * @param s
 * @throws CertificateException
 */

@Override
public void checkServerTrusted(X509Certificate[] x509Certificates, String s) throws CertificateException {

    //Clean the certificates and make sure they are in the proper order.
    int chainln = x509Certificates.length;
    if(x509Certificates.length > 1){
        //Clean the chains by matching issuer and subject fields until we can't continue
        int index;
        boolean foundNext;
        for(index=0; index < x509Certificates.length; ++index){
            foundNext = false;
            for(int nextIndex = index + 1; nextIndex < x509Certificates.length; ++nextIndex){
                //look for the next certificate in the chain.
                if(x509Certificates[index].getIssuerDN().equals(x509Certificates[nextIndex].getSubjectDN())){
                    foundNext = true;
                    //exchange certificates so that 0 through index+1 are in proper order.
                    if(nextIndex != index+1){
                        X509Certificate tempCert = x509Certificates[nextIndex];
                        x509Certificates[nextIndex] = x509Certificates[index+1];
                        x509Certificates[index+1] = tempCert;
                    }
                    break;
                }

            }

            if(!foundNext){
                break;
            }

        }

        //if the cert is self signed and if it is expired, if so we drop it and pass the rest to checkServerTrusted, hoping we may have a similar bu unexpired trusted root.
        chainln = index +1;
        X509Certificate lastCert = x509Certificates[chainln - 1];
        Date now = new Date();
        if(lastCert.getSubjectDN().equals(lastCert.getIssuerDN()) && now.after(lastCert.getNotAfter())){
            --chainln;
        }
    }

    defaultManager.checkServerTrusted(x509Certificates, s);

}

//you can add an accepted issuer
@Override
public X509Certificate[] getAcceptedIssuers() {
    return this.defaultManager.getAcceptedIssuers();
}
}

Step 2: Create a custom SSLSocketFactory that will implement our new trust manager.

/**
 * Created by Nevuroth on 1/19/15.
 */
    public class CustomSSLSocketFactory extends SSLSocketFactory {
SSLContext sslContext = SSLContext.getInstance("TLS");


public CustomSSLSocketFactory(KeyStore truststore) throws NoSuchAlgorithmException, KeyManagementException, UnrecoverableKeyException, KeyStoreException {
    super(truststore);

    TrustManager tm = new CustomX509TrustManager(truststore);

    sslContext.init(null, new TrustManager[]{tm}, null);

}

@Override
public Socket createSocket(Socket socket, String host, int port, boolean autoClose) throws IOException {
    return sslContext.getSocketFactory().createSocket(socket, host, port,autoClose);
}

@Override
public Socket createSocket() throws IOException{
    return sslContext.getSocketFactory().createSocket();
}
}

Step 3: Implement a new HTTPClient that uses the custom SSLSocketFactory that we just created. Use this when defining your HTTPClient for https connections.

public HttpClient getNewHttpClient(){
    try{
        KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
        trustStore.load(null, null);

        SSLSocketFactory sf = new CustomSSLSocketFactory(trustStore);
        //sf.setHostnameVerifier(SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);

        HttpParams params = new BasicHttpParams();
        HttpProtocolParams.setVersion(params, HttpVersion.HTTP_1_1);

        SchemeRegistry registry = new SchemeRegistry();
        registry.register(new Scheme("http", PlainSocketFactory.getSocketFactory(),80));
        registry.register(new Scheme("https", sf,443));

        ClientConnectionManager ccm = new ThreadSafeClientConnManager(params,registry);

        return new DefaultHttpClient(ccm, params);

    } catch (Exception e) {
        e.printStackTrace();
        //if we get an error here then we need to return something or a fatal network error will occur.
        return new DefaultHttpClient();
    }
}