Fatal编程技术网
  • https/
  • Https Google Play警告：如何修复HostnameVerifier的错误实现

Https Google Play警告：如何修复HostnameVerifier的错误实现

https

Https Google Play警告：如何修复HostnameVerifier的错误实现,https,warnings,android-security,Https,Warnings,Android Security,今天我刚收到谷歌发来的邮件： @Override public void onReceivedSslError(WebView view, final SslErrorHandler handler, SslError error) { // the main thing is to show dialog informing user // that SSL cert is invalid and prompt him to continue without // p

今天我刚收到谷歌发来的邮件：

@Override
            public void onReceivedSslError(WebView view, final SslErrorHandler handler, SslError error) {
// the main thing is to show dialog informing user
// that SSL cert is invalid and prompt him to continue without 
// protection: handler.proceed();
// or cancel: handler.cancel();
                String message;
                switch(error.getPrimaryError()) {
                    case SslError.SSL_DATE_INVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_date_invalid);
                        break;
                    case SslError.SSL_EXPIRED:
                        message = ResHelper.getString(R.string.ssl_cert_error_expired);
                        break;
                    case SslError.SSL_IDMISMATCH:
                        message = ResHelper.getString(R.string.ssl_cert_error_idmismatch);
                        break;
                    case SslError.SSL_INVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_invalid);
                        break;
                    case SslError.SSL_NOTYETVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_not_yet_valid);
                        break;
                    case SslError.SSL_UNTRUSTED:
                        message = ResHelper.getString(R.string.ssl_cert_error_untrusted);
                        break;
                    default:
                        message = ResHelper.getString(R.string.ssl_cert_error_cert_invalid);
                }
                mSSLConnectionDialog = new MaterialDialog.Builder(getParentActivity())
                        .title(R.string.ssl_cert_error_title)
                        .content(message)
                        .positiveText(R.string.continue_button)
                        .negativeText(R.string.cancel_button)
                        .titleColorRes(R.color.black)
                        .positiveColorRes(R.color.main_red)
                        .contentColorRes(R.color.comment_grey)
                        .backgroundColorRes(R.color.sides_menu_gray)
                        .onPositive(new MaterialDialog.SingleButtonCallback() {
                            @Override
                            public void onClick(MaterialDialog materialDialog, DialogAction dialogAction) {
                                mSSLConnectionDialog.dismiss();
                                handler.proceed();
                            }
                        })
                        .onNegative(new MaterialDialog.SingleButtonCallback() {
                            @Override
                            public void onClick(MaterialDialog materialDialog, DialogAction dialogAction) {
                                handler.cancel();
                            }
                        })
                        .build();
                mSSLConnectionDialog.show(); 
}
此电子邮件末尾列出的应用程序具有不安全的 HostnameVerifier接口的实现，它接受所有 使用建立到远程主机的HTTPS连接时的主机名 setDefaultHostnameVerifier API，从而使您的应用程序易受攻击 对中间人的攻击。攻击者可以读取传输的数据 （例如登录凭据），甚至更改在上传输的数据 HTTPS连接

@Override
            public void onReceivedSslError(WebView view, final SslErrorHandler handler, SslError error) {
// the main thing is to show dialog informing user
// that SSL cert is invalid and prompt him to continue without 
// protection: handler.proceed();
// or cancel: handler.cancel();
                String message;
                switch(error.getPrimaryError()) {
                    case SslError.SSL_DATE_INVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_date_invalid);
                        break;
                    case SslError.SSL_EXPIRED:
                        message = ResHelper.getString(R.string.ssl_cert_error_expired);
                        break;
                    case SslError.SSL_IDMISMATCH:
                        message = ResHelper.getString(R.string.ssl_cert_error_idmismatch);
                        break;
                    case SslError.SSL_INVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_invalid);
                        break;
                    case SslError.SSL_NOTYETVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_not_yet_valid);
                        break;
                    case SslError.SSL_UNTRUSTED:
                        message = ResHelper.getString(R.string.ssl_cert_error_untrusted);
                        break;
                    default:
                        message = ResHelper.getString(R.string.ssl_cert_error_cert_invalid);
                }
                mSSLConnectionDialog = new MaterialDialog.Builder(getParentActivity())
                        .title(R.string.ssl_cert_error_title)
                        .content(message)
                        .positiveText(R.string.continue_button)
                        .negativeText(R.string.cancel_button)
                        .titleColorRes(R.color.black)
                        .positiveColorRes(R.color.main_red)
                        .contentColorRes(R.color.comment_grey)
                        .backgroundColorRes(R.color.sides_menu_gray)
                        .onPositive(new MaterialDialog.SingleButtonCallback() {
                            @Override
                            public void onClick(MaterialDialog materialDialog, DialogAction dialogAction) {
                                mSSLConnectionDialog.dismiss();
                                handler.proceed();
                            }
                        })
                        .onNegative(new MaterialDialog.SingleButtonCallback() {
                            @Override
                            public void onClick(MaterialDialog materialDialog, DialogAction dialogAction) {
                                handler.cancel();
                            }
                        })
                        .build();
                mSSLConnectionDialog.show(); 
}
不幸的是，我搜索了我所有的代码，发现没有使用HostnameVerifier，也没有使用setDefaultHostnameVerifier，甚至没有任何HTTPS连接

@Override
            public void onReceivedSslError(WebView view, final SslErrorHandler handler, SslError error) {
// the main thing is to show dialog informing user
// that SSL cert is invalid and prompt him to continue without 
// protection: handler.proceed();
// or cancel: handler.cancel();
                String message;
                switch(error.getPrimaryError()) {
                    case SslError.SSL_DATE_INVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_date_invalid);
                        break;
                    case SslError.SSL_EXPIRED:
                        message = ResHelper.getString(R.string.ssl_cert_error_expired);
                        break;
                    case SslError.SSL_IDMISMATCH:
                        message = ResHelper.getString(R.string.ssl_cert_error_idmismatch);
                        break;
                    case SslError.SSL_INVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_invalid);
                        break;
                    case SslError.SSL_NOTYETVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_not_yet_valid);
                        break;
                    case SslError.SSL_UNTRUSTED:
                        message = ResHelper.getString(R.string.ssl_cert_error_untrusted);
                        break;
                    default:
                        message = ResHelper.getString(R.string.ssl_cert_error_cert_invalid);
                }
                mSSLConnectionDialog = new MaterialDialog.Builder(getParentActivity())
                        .title(R.string.ssl_cert_error_title)
                        .content(message)
                        .positiveText(R.string.continue_button)
                        .negativeText(R.string.cancel_button)
                        .titleColorRes(R.color.black)
                        .positiveColorRes(R.color.main_red)
                        .contentColorRes(R.color.comment_grey)
                        .backgroundColorRes(R.color.sides_menu_gray)
                        .onPositive(new MaterialDialog.SingleButtonCallback() {
                            @Override
                            public void onClick(MaterialDialog materialDialog, DialogAction dialogAction) {
                                mSSLConnectionDialog.dismiss();
                                handler.proceed();
                            }
                        })
                        .onNegative(new MaterialDialog.SingleButtonCallback() {
                            @Override
                            public void onClick(MaterialDialog materialDialog, DialogAction dialogAction) {
                                handler.cancel();
                            }
                        })
                        .build();
                mSSLConnectionDialog.show(); 
}
我正在使用谷歌最新版本的兼容性库：25.0.1，在我的一些应用程序中使用谷歌广告9.8.0。将广告升级到10.0.1，因为我只能假设罪犯就在那里

@Override
            public void onReceivedSslError(WebView view, final SslErrorHandler handler, SslError error) {
// the main thing is to show dialog informing user
// that SSL cert is invalid and prompt him to continue without 
// protection: handler.proceed();
// or cancel: handler.cancel();
                String message;
                switch(error.getPrimaryError()) {
                    case SslError.SSL_DATE_INVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_date_invalid);
                        break;
                    case SslError.SSL_EXPIRED:
                        message = ResHelper.getString(R.string.ssl_cert_error_expired);
                        break;
                    case SslError.SSL_IDMISMATCH:
                        message = ResHelper.getString(R.string.ssl_cert_error_idmismatch);
                        break;
                    case SslError.SSL_INVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_invalid);
                        break;
                    case SslError.SSL_NOTYETVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_not_yet_valid);
                        break;
                    case SslError.SSL_UNTRUSTED:
                        message = ResHelper.getString(R.string.ssl_cert_error_untrusted);
                        break;
                    default:
                        message = ResHelper.getString(R.string.ssl_cert_error_cert_invalid);
                }
                mSSLConnectionDialog = new MaterialDialog.Builder(getParentActivity())
                        .title(R.string.ssl_cert_error_title)
                        .content(message)
                        .positiveText(R.string.continue_button)
                        .negativeText(R.string.cancel_button)
                        .titleColorRes(R.color.black)
                        .positiveColorRes(R.color.main_red)
                        .contentColorRes(R.color.comment_grey)
                        .backgroundColorRes(R.color.sides_menu_gray)
                        .onPositive(new MaterialDialog.SingleButtonCallback() {
                            @Override
                            public void onClick(MaterialDialog materialDialog, DialogAction dialogAction) {
                                mSSLConnectionDialog.dismiss();
                                handler.proceed();
                            }
                        })
                        .onNegative(new MaterialDialog.SingleButtonCallback() {
                            @Override
                            public void onClick(MaterialDialog materialDialog, DialogAction dialogAction) {
                                handler.cancel();
                            }
                        })
                        .build();
                mSSLConnectionDialog.show(); 
}
是否有人收到此警报？如果有，您是如何解决的？

此处相同-在APK中检测到不安全的主机名验证程序

@Override
            public void onReceivedSslError(WebView view, final SslErrorHandler handler, SslError error) {
// the main thing is to show dialog informing user
// that SSL cert is invalid and prompt him to continue without 
// protection: handler.proceed();
// or cancel: handler.cancel();
                String message;
                switch(error.getPrimaryError()) {
                    case SslError.SSL_DATE_INVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_date_invalid);
                        break;
                    case SslError.SSL_EXPIRED:
                        message = ResHelper.getString(R.string.ssl_cert_error_expired);
                        break;
                    case SslError.SSL_IDMISMATCH:
                        message = ResHelper.getString(R.string.ssl_cert_error_idmismatch);
                        break;
                    case SslError.SSL_INVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_invalid);
                        break;
                    case SslError.SSL_NOTYETVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_not_yet_valid);
                        break;
                    case SslError.SSL_UNTRUSTED:
                        message = ResHelper.getString(R.string.ssl_cert_error_untrusted);
                        break;
                    default:
                        message = ResHelper.getString(R.string.ssl_cert_error_cert_invalid);
                }
                mSSLConnectionDialog = new MaterialDialog.Builder(getParentActivity())
                        .title(R.string.ssl_cert_error_title)
                        .content(message)
                        .positiveText(R.string.continue_button)
                        .negativeText(R.string.cancel_button)
                        .titleColorRes(R.color.black)
                        .positiveColorRes(R.color.main_red)
                        .contentColorRes(R.color.comment_grey)
                        .backgroundColorRes(R.color.sides_menu_gray)
                        .onPositive(new MaterialDialog.SingleButtonCallback() {
                            @Override
                            public void onClick(MaterialDialog materialDialog, DialogAction dialogAction) {
                                mSSLConnectionDialog.dismiss();
                                handler.proceed();
                            }
                        })
                        .onNegative(new MaterialDialog.SingleButtonCallback() {
                            @Override
                            public void onClick(MaterialDialog materialDialog, DialogAction dialogAction) {
                                handler.cancel();
                            }
                        })
                        .build();
                mSSLConnectionDialog.show(); 
}
您的应用程序正在使用HostnameVerifier的不安全实现。请 有关详细信息，请参阅此Google帮助中心文章，包括 修复漏洞的截止日期。我没有使用主机名验证程序 不调用setDefaultHostnameVerifier。此外，我使用OKHTTP http请求的库。我希望定义TrustManager能够解决这个问题 这个问题

@Override
            public void onReceivedSslError(WebView view, final SslErrorHandler handler, SslError error) {
// the main thing is to show dialog informing user
// that SSL cert is invalid and prompt him to continue without 
// protection: handler.proceed();
// or cancel: handler.cancel();
                String message;
                switch(error.getPrimaryError()) {
                    case SslError.SSL_DATE_INVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_date_invalid);
                        break;
                    case SslError.SSL_EXPIRED:
                        message = ResHelper.getString(R.string.ssl_cert_error_expired);
                        break;
                    case SslError.SSL_IDMISMATCH:
                        message = ResHelper.getString(R.string.ssl_cert_error_idmismatch);
                        break;
                    case SslError.SSL_INVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_invalid);
                        break;
                    case SslError.SSL_NOTYETVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_not_yet_valid);
                        break;
                    case SslError.SSL_UNTRUSTED:
                        message = ResHelper.getString(R.string.ssl_cert_error_untrusted);
                        break;
                    default:
                        message = ResHelper.getString(R.string.ssl_cert_error_cert_invalid);
                }
                mSSLConnectionDialog = new MaterialDialog.Builder(getParentActivity())
                        .title(R.string.ssl_cert_error_title)
                        .content(message)
                        .positiveText(R.string.continue_button)
                        .negativeText(R.string.cancel_button)
                        .titleColorRes(R.color.black)
                        .positiveColorRes(R.color.main_red)
                        .contentColorRes(R.color.comment_grey)
                        .backgroundColorRes(R.color.sides_menu_gray)
                        .onPositive(new MaterialDialog.SingleButtonCallback() {
                            @Override
                            public void onClick(MaterialDialog materialDialog, DialogAction dialogAction) {
                                mSSLConnectionDialog.dismiss();
                                handler.proceed();
                            }
                        })
                        .onNegative(new MaterialDialog.SingleButtonCallback() {
                            @Override
                            public void onClick(MaterialDialog materialDialog, DialogAction dialogAction) {
                                handler.cancel();
                            }
                        })
                        .build();
                mSSLConnectionDialog.show(); 
}
由于我没有子类化
主机名验证程序
或调用
setdefaulthostnamevilizer（）
，我假设它依赖于某个第三方库。由于我无法检测到这样的库，我想我将尝试添加一个具有以下代码的类

    HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier() {
        public boolean verify(final String hostname, final SSLSession session) {
            if (check if SSL is really valid)
                return true;
            else
                return false;
        }
    });

@Override
            public void onReceivedSslError(WebView view, final SslErrorHandler handler, SslError error) {
// the main thing is to show dialog informing user
// that SSL cert is invalid and prompt him to continue without 
// protection: handler.proceed();
// or cancel: handler.cancel();
                String message;
                switch(error.getPrimaryError()) {
                    case SslError.SSL_DATE_INVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_date_invalid);
                        break;
                    case SslError.SSL_EXPIRED:
                        message = ResHelper.getString(R.string.ssl_cert_error_expired);
                        break;
                    case SslError.SSL_IDMISMATCH:
                        message = ResHelper.getString(R.string.ssl_cert_error_idmismatch);
                        break;
                    case SslError.SSL_INVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_invalid);
                        break;
                    case SslError.SSL_NOTYETVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_not_yet_valid);
                        break;
                    case SslError.SSL_UNTRUSTED:
                        message = ResHelper.getString(R.string.ssl_cert_error_untrusted);
                        break;
                    default:
                        message = ResHelper.getString(R.string.ssl_cert_error_cert_invalid);
                }
                mSSLConnectionDialog = new MaterialDialog.Builder(getParentActivity())
                        .title(R.string.ssl_cert_error_title)
                        .content(message)
                        .positiveText(R.string.continue_button)
                        .negativeText(R.string.cancel_button)
                        .titleColorRes(R.color.black)
                        .positiveColorRes(R.color.main_red)
                        .contentColorRes(R.color.comment_grey)
                        .backgroundColorRes(R.color.sides_menu_gray)
                        .onPositive(new MaterialDialog.SingleButtonCallback() {
                            @Override
                            public void onClick(MaterialDialog materialDialog, DialogAction dialogAction) {
                                mSSLConnectionDialog.dismiss();
                                handler.proceed();
                            }
                        })
                        .onNegative(new MaterialDialog.SingleButtonCallback() {
                            @Override
                            public void onClick(MaterialDialog materialDialog, DialogAction dialogAction) {
                                handler.cancel();
                            }
                        })
                        .build();
                mSSLConnectionDialog.show(); 
}
请访问我的项目，并查看它是否解决了问题。
所以我这样做了，并且在每个webView中添加了重写方法

@Override
            public void onReceivedSslError(WebView view, final SslErrorHandler handler, SslError error) {
// the main thing is to show dialog informing user
// that SSL cert is invalid and prompt him to continue without 
// protection: handler.proceed();
// or cancel: handler.cancel();
                String message;
                switch(error.getPrimaryError()) {
                    case SslError.SSL_DATE_INVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_date_invalid);
                        break;
                    case SslError.SSL_EXPIRED:
                        message = ResHelper.getString(R.string.ssl_cert_error_expired);
                        break;
                    case SslError.SSL_IDMISMATCH:
                        message = ResHelper.getString(R.string.ssl_cert_error_idmismatch);
                        break;
                    case SslError.SSL_INVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_invalid);
                        break;
                    case SslError.SSL_NOTYETVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_not_yet_valid);
                        break;
                    case SslError.SSL_UNTRUSTED:
                        message = ResHelper.getString(R.string.ssl_cert_error_untrusted);
                        break;
                    default:
                        message = ResHelper.getString(R.string.ssl_cert_error_cert_invalid);
                }
                mSSLConnectionDialog = new MaterialDialog.Builder(getParentActivity())
                        .title(R.string.ssl_cert_error_title)
                        .content(message)
                        .positiveText(R.string.continue_button)
                        .negativeText(R.string.cancel_button)
                        .titleColorRes(R.color.black)
                        .positiveColorRes(R.color.main_red)
                        .contentColorRes(R.color.comment_grey)
                        .backgroundColorRes(R.color.sides_menu_gray)
                        .onPositive(new MaterialDialog.SingleButtonCallback() {
                            @Override
                            public void onClick(MaterialDialog materialDialog, DialogAction dialogAction) {
                                mSSLConnectionDialog.dismiss();
                                handler.proceed();
                            }
                        })
                        .onNegative(new MaterialDialog.SingleButtonCallback() {
                            @Override
                            public void onClick(MaterialDialog materialDialog, DialogAction dialogAction) {
                                handler.cancel();
                            }
                        })
                        .build();
                mSSLConnectionDialog.show(); 
}
到

@Override
            public void onReceivedSslError(WebView view, final SslErrorHandler handler, SslError error) {
// the main thing is to show dialog informing user
// that SSL cert is invalid and prompt him to continue without 
// protection: handler.proceed();
// or cancel: handler.cancel();
                String message;
                switch(error.getPrimaryError()) {
                    case SslError.SSL_DATE_INVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_date_invalid);
                        break;
                    case SslError.SSL_EXPIRED:
                        message = ResHelper.getString(R.string.ssl_cert_error_expired);
                        break;
                    case SslError.SSL_IDMISMATCH:
                        message = ResHelper.getString(R.string.ssl_cert_error_idmismatch);
                        break;
                    case SslError.SSL_INVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_invalid);
                        break;
                    case SslError.SSL_NOTYETVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_not_yet_valid);
                        break;
                    case SslError.SSL_UNTRUSTED:
                        message = ResHelper.getString(R.string.ssl_cert_error_untrusted);
                        break;
                    default:
                        message = ResHelper.getString(R.string.ssl_cert_error_cert_invalid);
                }
                mSSLConnectionDialog = new MaterialDialog.Builder(getParentActivity())
                        .title(R.string.ssl_cert_error_title)
                        .content(message)
                        .positiveText(R.string.continue_button)
                        .negativeText(R.string.cancel_button)
                        .titleColorRes(R.color.black)
                        .positiveColorRes(R.color.main_red)
                        .contentColorRes(R.color.comment_grey)
                        .backgroundColorRes(R.color.sides_menu_gray)
                        .onPositive(new MaterialDialog.SingleButtonCallback() {
                            @Override
                            public void onClick(MaterialDialog materialDialog, DialogAction dialogAction) {
                                mSSLConnectionDialog.dismiss();
                                handler.proceed();
                            }
                        })
                        .onNegative(new MaterialDialog.SingleButtonCallback() {
                            @Override
                            public void onClick(MaterialDialog materialDialog, DialogAction dialogAction) {
                                handler.cancel();
                            }
                        })
                        .build();
                mSSLConnectionDialog.show(); 
}

mWebView.setWebViewClient(new WebViewClient() {
... // other corresponding overridden methods
}
最后谷歌说：

@Override
            public void onReceivedSslError(WebView view, final SslErrorHandler handler, SslError error) {
// the main thing is to show dialog informing user
// that SSL cert is invalid and prompt him to continue without 
// protection: handler.proceed();
// or cancel: handler.cancel();
                String message;
                switch(error.getPrimaryError()) {
                    case SslError.SSL_DATE_INVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_date_invalid);
                        break;
                    case SslError.SSL_EXPIRED:
                        message = ResHelper.getString(R.string.ssl_cert_error_expired);
                        break;
                    case SslError.SSL_IDMISMATCH:
                        message = ResHelper.getString(R.string.ssl_cert_error_idmismatch);
                        break;
                    case SslError.SSL_INVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_invalid);
                        break;
                    case SslError.SSL_NOTYETVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_not_yet_valid);
                        break;
                    case SslError.SSL_UNTRUSTED:
                        message = ResHelper.getString(R.string.ssl_cert_error_untrusted);
                        break;
                    default:
                        message = ResHelper.getString(R.string.ssl_cert_error_cert_invalid);
                }
                mSSLConnectionDialog = new MaterialDialog.Builder(getParentActivity())
                        .title(R.string.ssl_cert_error_title)
                        .content(message)
                        .positiveText(R.string.continue_button)
                        .negativeText(R.string.cancel_button)
                        .titleColorRes(R.color.black)
                        .positiveColorRes(R.color.main_red)
                        .contentColorRes(R.color.comment_grey)
                        .backgroundColorRes(R.color.sides_menu_gray)
                        .onPositive(new MaterialDialog.SingleButtonCallback() {
                            @Override
                            public void onClick(MaterialDialog materialDialog, DialogAction dialogAction) {
                                mSSLConnectionDialog.dismiss();
                                handler.proceed();
                            }
                        })
                        .onNegative(new MaterialDialog.SingleButtonCallback() {
                            @Override
                            public void onClick(MaterialDialog materialDialog, DialogAction dialogAction) {
                                handler.cancel();
                            }
                        })
                        .build();
                mSSLConnectionDialog.show(); 
}
安全扫描完成
未检测到APK 158的已知漏洞

@Override
            public void onReceivedSslError(WebView view, final SslErrorHandler handler, SslError error) {
// the main thing is to show dialog informing user
// that SSL cert is invalid and prompt him to continue without 
// protection: handler.proceed();
// or cancel: handler.cancel();
                String message;
                switch(error.getPrimaryError()) {
                    case SslError.SSL_DATE_INVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_date_invalid);
                        break;
                    case SslError.SSL_EXPIRED:
                        message = ResHelper.getString(R.string.ssl_cert_error_expired);
                        break;
                    case SslError.SSL_IDMISMATCH:
                        message = ResHelper.getString(R.string.ssl_cert_error_idmismatch);
                        break;
                    case SslError.SSL_INVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_invalid);
                        break;
                    case SslError.SSL_NOTYETVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_not_yet_valid);
                        break;
                    case SslError.SSL_UNTRUSTED:
                        message = ResHelper.getString(R.string.ssl_cert_error_untrusted);
                        break;
                    default:
                        message = ResHelper.getString(R.string.ssl_cert_error_cert_invalid);
                }
                mSSLConnectionDialog = new MaterialDialog.Builder(getParentActivity())
                        .title(R.string.ssl_cert_error_title)
                        .content(message)
                        .positiveText(R.string.continue_button)
                        .negativeText(R.string.cancel_button)
                        .titleColorRes(R.color.black)
                        .positiveColorRes(R.color.main_red)
                        .contentColorRes(R.color.comment_grey)
                        .backgroundColorRes(R.color.sides_menu_gray)
                        .onPositive(new MaterialDialog.SingleButtonCallback() {
                            @Override
                            public void onClick(MaterialDialog materialDialog, DialogAction dialogAction) {
                                mSSLConnectionDialog.dismiss();
                                handler.proceed();
                            }
                        })
                        .onNegative(new MaterialDialog.SingleButtonCallback() {
                            @Override
                            public void onClick(MaterialDialog materialDialog, DialogAction dialogAction) {
                                handler.cancel();
                            }
                        })
                        .build();
                mSSLConnectionDialog.show(); 
}
但是我不确定是什么代码造成的，
mWebView.setWebViewClient的
HostNameVerifier
或
OnReceivedSlerror（）
根据从Google收到的邮件，这个问题可能有两种可能性：


@Override
            public void onReceivedSslError(WebView view, final SslErrorHandler handler, SslError error) {
// the main thing is to show dialog informing user
// that SSL cert is invalid and prompt him to continue without 
// protection: handler.proceed();
// or cancel: handler.cancel();
                String message;
                switch(error.getPrimaryError()) {
                    case SslError.SSL_DATE_INVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_date_invalid);
                        break;
                    case SslError.SSL_EXPIRED:
                        message = ResHelper.getString(R.string.ssl_cert_error_expired);
                        break;
                    case SslError.SSL_IDMISMATCH:
                        message = ResHelper.getString(R.string.ssl_cert_error_idmismatch);
                        break;
                    case SslError.SSL_INVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_invalid);
                        break;
                    case SslError.SSL_NOTYETVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_not_yet_valid);
                        break;
                    case SslError.SSL_UNTRUSTED:
                        message = ResHelper.getString(R.string.ssl_cert_error_untrusted);
                        break;
                    default:
                        message = ResHelper.getString(R.string.ssl_cert_error_cert_invalid);
                }
                mSSLConnectionDialog = new MaterialDialog.Builder(getParentActivity())
                        .title(R.string.ssl_cert_error_title)
                        .content(message)
                        .positiveText(R.string.continue_button)
                        .negativeText(R.string.cancel_button)
                        .titleColorRes(R.color.black)
                        .positiveColorRes(R.color.main_red)
                        .contentColorRes(R.color.comment_grey)
                        .backgroundColorRes(R.color.sides_menu_gray)
                        .onPositive(new MaterialDialog.SingleButtonCallback() {
                            @Override
                            public void onClick(MaterialDialog materialDialog, DialogAction dialogAction) {
                                mSSLConnectionDialog.dismiss();
                                handler.proceed();
                            }
                        })
                        .onNegative(new MaterialDialog.SingleButtonCallback() {
                            @Override
                            public void onClick(MaterialDialog materialDialog, DialogAction dialogAction) {
                                handler.cancel();
                            }
                        })
                        .build();
                mSSLConnectionDialog.show(); 
}


首先，你必须检查你的包名没有使用任何谷歌限制的关键字。例如，“com.companyname.android”，.android是不允许的。第二步是检查HostNameVerifier


@Override
            public void onReceivedSslError(WebView view, final SslErrorHandler handler, SslError error) {
// the main thing is to show dialog informing user
// that SSL cert is invalid and prompt him to continue without 
// protection: handler.proceed();
// or cancel: handler.cancel();
                String message;
                switch(error.getPrimaryError()) {
                    case SslError.SSL_DATE_INVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_date_invalid);
                        break;
                    case SslError.SSL_EXPIRED:
                        message = ResHelper.getString(R.string.ssl_cert_error_expired);
                        break;
                    case SslError.SSL_IDMISMATCH:
                        message = ResHelper.getString(R.string.ssl_cert_error_idmismatch);
                        break;
                    case SslError.SSL_INVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_invalid);
                        break;
                    case SslError.SSL_NOTYETVALID:
                        message = ResHelper.getString(R.string.ssl_cert_error_not_yet_valid);
                        break;
                    case SslError.SSL_UNTRUSTED:
                        message = ResHelper.getString(R.string.ssl_cert_error_untrusted);
                        break;
                    default:
                        message = ResHelper.getString(R.string.ssl_cert_error_cert_invalid);
                }
                mSSLConnectionDialog = new MaterialDialog.Builder(getParentActivity())
                        .title(R.string.ssl_cert_error_title)
                        .content(message)
                        .positiveText(R.string.continue_button)
                        .negativeText(R.string.cancel_button)
                        .titleColorRes(R.color.black)
                        .positiveColorRes(R.color.main_red)
                        .contentColorRes(R.color.comment_grey)
                        .backgroundColorRes(R.color.sides_menu_gray)
                        .onPositive(new MaterialDialog.SingleButtonCallback() {
                            @Override
                            public void onClick(MaterialDialog materialDialog, DialogAction dialogAction) {
                                mSSLConnectionDialog.dismiss();
                                handler.proceed();
                            }
                        })
                        .onNegative(new MaterialDialog.SingleButtonCallback() {
                            @Override
                            public void onClick(MaterialDialog materialDialog, DialogAction dialogAction) {
                                handler.cancel();
                            }
                        })
                        .build();
                mSSLConnectionDialog.show(); 
}



HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier() {
    public boolean verify(final String hostname, final SSLSession session) {
        if (/* check if SSL is really valid */)
            return true;
        else
            return false;
    }
});



您是否使用像Glide这样的第三方LIB？这里有相同的警报，不知道如何修复。代码中没有HostNameVerifier的直接实现。仅使用谷歌广告和谷歌兼容性库。我的一些项目包括Xposed framwork JAR、jcifs samba源代码和apachecommons.net源代码。但受影响的项目没有这些。您是如何获得此安全扫描的？我刚刚发布了一个更新的APK，没有收到任何警告或看到这样的扫描？也许我没有注意。当你上传apk（菜单->apk）到存储时，将其作为测试版（我不知道它是否与生产版相同）并在一段时间后转到菜单->启动前报告（从apk开始的第三个选项）到安全选项卡。“”安全扫描完成没有检测到apk 26的已知漏洞。”“”我收到了这条消息，但警报仍然存在。有什么想法吗？好的，好了。问题解决了。更新问题状态大约需要15小时。3月1日是我的最后期限。有人能在给出的答案中解释一下（检查SSL是否真的有效）吗