Behavior of HttpURLConnection for URL with Revoked SSL Certificate?
android, https, java, ssl
Solution
The expected behavior would be for `X509TrustManager` to catch a `CertPathValidatorException` from `CertPathValidator` and re-throw it as a `CertificateException` (a `CertificateRevokedException` when available in Android).
CRL checking is disabled here, on line 362. Note that its not as easy as removing that line, since if a cert has no CRL, a `CertPathValidatorException` is also thrown.
CertPathValidator is implemented here and as far as I can tell, by wandering through the source, it doesn't download the CRL's.
Problem
We're going to have a bumper crop of revoked SSL certificates, courtesy of heartbleed. When I saw that Chrome on Android apparently ignores revoked SSL certificates, I wondered what the behavior would be when requesting in Java a Web resource from a server, where we get a revoked SSL certificate. What I hoped for was a crash with some sort of `SSLHandshakeException`. What I am seeing is a successful connection, but downloading no data -- reading from `getInputStream()` returns a length of -1. This is tested using https://revoked.grc.com/ as my test site, which will return an explanatory page if you download it ignoring certificate errors (e.g., via `wget -no-check-certificate`). I have tried 4.4, 4.3, and 2.3 emulators, with the same results. Is there a specified behavior for the Java VM? I doubt that there is an Android-specific specification, but if Android's actual behavior differs from a Java specification, I can work to get the differences clarified as either being bugs or missing documentation.