Question

In my android application I have to a read an XML file that is stored in a server. Since this is a secured web page[SSL(https)], to access to the location(https://serverAddress/path/) where the XML file resides, normally it requires username/Password Authentication

Following is the Code that I used to read and get the XML Stream. But it always goes to the exception when it trying to execute the HttpResponse httpResponse = httpClient.execute(httpGet); statement. Exception says Not trusted server certificate.

Also have added the internet access permission <uses-permission android:name="android.permission.INTERNET" /> in the Manifest file

If the XML file is stored in a place where it doesn’t require any authentication, then it works fine. I searched everywhere but didn’t find any example that will do this. If someone can guide through this process I would be really grateful. Thanks in advance…!!!!

   try
   {
         Log.v("State","Started...");

         HttpClient httpClient = new DefaultHttpClient();
         HttpGet httpGet = new HttpGet("https://serverAddress/path/MyXMLFile.xml");
         httpGet.addHeader(BasicScheme.authenticate(new UsernamePasswordCredentials("username", "password"),HTTP.UTF_8, false));
         HttpResponse httpResponse = httpClient.execute(httpGet);
         InputStream xmlInputStream = httpResponse.getEntity().getContent();
         Toast.makeText(getApplicationContext(), this.convertStreamToString(xmlInputStream), Toast.LENGTH_LONG).show();

         Log.v("State","Finish...");
    }
    catch(Exception e)
    {
        Log.v("State",e.getMessage().toString());
    }

Answer 1

This is not http question it is https – you are using secure connection. I also had a lot of troubles with those. As a quick fix you can get your client to trust all certificates using this irreplaceable post.

Later on consider trusting only the appropriate certificates.

EDIT: because I know how picky SO users are. Yes it is bad practise to trust all certificates, but this can be done in 3 minutes and you can test the rest of your code. Still never forget this is potential security breach and you should switch to trusting only specified certificate.