How to Disable SSL Certificate Verification in Retrofit Library?

Question

How can I disable SSL certificate verification in the Retrofit library for Android applications?

// Example of creating a custom OkHttpClient with SSL verification disabled
OkHttpClient.Builder builder = new OkHttpClient.Builder();
TrustManager[] trustAllCerts = new TrustManager[] {
    new X509TrustManager() {
        public void checkClientTrusted(X509Certificate[] chain, String authType) {}
        public void checkServerTrusted(X509Certificate[] chain, String authType) {}
        public X509Certificate[] getAcceptedIssuers() {
            return new X509Certificate[0];
        }
    }
};
SSLContext sslContext = SSLContext.getInstance("SSL");
sslContext.init(null, trustAllCerts, new SecureRandom());
builder.sslSocketFactory(sslContext.getSocketFactory(), (X509TrustManager)trustAllCerts[0]);
Retrofit retrofit = new Retrofit.Builder()
        .baseUrl(BASE_URL)
        .client(builder.build())
        .build();

Answer

Disabling SSL certificate verification is often required during development stages, especially for apps connecting to servers with self-signed certificates. However, keep in mind that bypassing SSL checks can expose your application to man-in-the-middle attacks, so it should only be used with caution and never in production environments.

// Custom implementation for Retrofit disallowing SSL certificate verification
OkHttpClient.Builder builder = new OkHttpClient.Builder();
TrustManager[] trustAllCerts = new TrustManager[] {
    new X509TrustManager() {
        public void checkClientTrusted(X509Certificate[] chain, String authType) {}
        public void checkServerTrusted(X509Certificate[] chain, String authType) {}
        public X509Certificate[] getAcceptedIssuers() {
            return new X509Certificate[0];
        }
    }
};
SSLContext sslContext = SSLContext.getInstance("SSL");
sslContext.init(null, trustAllCerts, new SecureRandom());
builder.sslSocketFactory(sslContext.getSocketFactory(), (X509TrustManager)trustAllCerts[0]);
Retrofit retrofit = new Retrofit.Builder()
        .baseUrl(BASE_URL)
        .client(builder.build())
        .build();

Causes

Using a self-signed SSL certificate for development purposes.
Connecting to an API endpoint with an invalid or expired certificate.
Testing in localhost environments that do not support proper SSL certification.

Solutions

Utilize a dedicated development server with a valid SSL certificate during development.
Incorporate SSL pinning in production to enhance security even when disabling checks in development.
Restrict disabling SSL checks to build variants intended for test or debug purposes only.

Common Mistakes

Mistake: Using this configuration in production without proper security checks

Solution: Always ensure that SSL verification is enabled in production and consider using SSL pinning.

Mistake: Neglecting to handle IOException that may arise

Solution: Properly configure error handling for network requests to manage exceptions and provide user-friendly feedback.

Helpers

Retrofit SSL certificate check
Disable SSL verification Retrofit
Android Retrofit HTTPS
Trust all SSL certificates Retrofit