fix: remove cert verification bypass

Author: bwees

android/app/src/main/AndroidManifest.xml

@@ -7,6 +7,7 @@
         android:label="@string/app_name"
         android:roundIcon="@mipmap/ic_launcher_round"
         android:supportsRtl="true"
+        android:networkSecurityConfig="@xml/network_security_config"
         android:theme="@style/AppTheme">
 
         <activity

android/app/src/main/java/com/maroonrides/maroonrides/MainActivity.java

@@ -2,14 +2,6 @@
 
 import android.os.Bundle;
 import com.getcapacitor.BridgeActivity;
-import java.security.SecureRandom;
-import java.security.cert.X509Certificate;
-import javax.net.ssl.HostnameVerifier;
-import javax.net.ssl.HttpsURLConnection;
-import javax.net.ssl.SSLContext;
-import javax.net.ssl.SSLSession;
-import javax.net.ssl.TrustManager;
-import javax.net.ssl.X509TrustManager;
 
 public class MainActivity extends BridgeActivity {
     @Override
@@ -18,40 +10,5 @@ public void onCreate(Bundle savedInstanceState) {
         registerPlugin(LegacyPrefsPlugin.class);
 
         super.onCreate(savedInstanceState);
-
-        // DANGER: Forces the native Java layer to accept expired/invalid certs
-        bypassNativeSSLChecks();
-    }
-
-    private void bypassNativeSSLChecks() {
-        try {
-            TrustManager[] trustAllCerts = new TrustManager[] {
-                    new X509TrustManager() {
-                        public X509Certificate[] getAcceptedIssuers() {
-                            return new X509Certificate[0];
-                        }
-
-                        public void checkClientTrusted(X509Certificate[] certs, String authType) {
-                        }
-
-                        public void checkServerTrusted(X509Certificate[] certs, String authType) {
-                        }
-                    }
-            };
-
-            SSLContext sc = SSLContext.getInstance("SSL");
-            sc.init(null, trustAllCerts, new SecureRandom());
-
-            // Apply trust-all logic globally to native requests
-            HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
-            HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier() {
-                @Override
-                public boolean verify(String arg0, SSLSession arg1) {
-                    return true;
-                }
-            });
-        } catch (Exception e) {
-            e.printStackTrace();
-        }
     }
 }

android/app/src/main/res/raw/incommon_rsa_ov_ssl_ca3.pem

@@ -0,0 +1,35 @@
+-----BEGIN CERTIFICATE-----
+MIIGIzCCBAugAwIBAgIRAJa22zsNXLm6Xd6KrItt/ncwDQYJKoZIhvcNAQEMBQAw
+XzELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE2MDQGA1UE
+AxMtU2VjdGlnbyBQdWJsaWMgU2VydmVyIEF1dGhlbnRpY2F0aW9uIFJvb3QgUjQ2
+MB4XDTI1MTEwNjAwMDAwMFoXDTM1MTEwNTIzNTk1OVowSDELMAkGA1UEBhMCVVMx
+FjAUBgNVBAoTDUluQ29tbW9uLCBMTEMxITAfBgNVBAMTGEluQ29tbW9uIFJTQSBP
+ViBTU0wgQ0EgMzCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAInzD7j/
+Ja1OZOvyIIe2hFOdDrois8Iiuyh+RtSKaKyQAvSRdG1b0Iz+fxOZaNPlM2RCTa9N
+Ar/bs9Tts4RXTDCuLJfCPPwbRtSZMvBrZVpcPU3xVBbTUHTsYZ+SmlzB+qIwEJV6
+TU8vEsdqosCwA/iOXewiRmUf5FxU2WoU4nD8iVFhu/p6h6YmI+AgswZ4lwZdNKW5
+9cTvpuY8VefEWHuwvSQlzekLLBqiFJhlCu8dNrBsahT07sjMHVZVHU8Biss3bX04
+FTzkDzv5eZ/U2LFA0rV2QzLpeLtIsMsXhlrEmuT4g6cbJJ3ZfWGHX77jnCIczshi
+taD1BiTA9PRv9JWW6xQ+cGfHRMyHWTBNhdQI22N9UO65R+6ddwEWupViEGRUuO/O
+ZbTtBSkoEBejHBfI3/BnnhLpKXTGC5N20om7nQ2UqOcgOpewiE9P+DnMrnUsqp9e
+IS6NgkCCCuhS6eoHS3DwJouIK1T5CE/4xSrEuU0QTFRJfyqlIaMbKMe+awIDAQAB
+o4IBbzCCAWswHwYDVR0jBBgwFoAUVnNYZJX5khqwEioEYnmhQBWIIUkwHQYDVR0O
+BBYEFNoiNz/l03Ta2Xk+0XJt1ZNLIDevMA4GA1UdDwEB/wQEAwIBhjASBgNVHRMB
+Af8ECDAGAQH/AgEAMBMGA1UdJQQMMAoGCCsGAQUFBwMBMBMGA1UdIAQMMAowCAYG
+Z4EMAQICMFQGA1UdHwRNMEswSaBHoEWGQ2h0dHA6Ly9jcmwuc2VjdGlnby5jb20v
+U2VjdGlnb1B1YmxpY1NlcnZlckF1dGhlbnRpY2F0aW9uUm9vdFI0Ni5jcmwwgYQG
+CCsGAQUFBwEBBHgwdjBPBggrBgEFBQcwAoZDaHR0cDovL2NydC5zZWN0aWdvLmNv
+bS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LnA3YzAj
+BggrBgEFBQcwAYYXaHR0cDovL29jc3Auc2VjdGlnby5jb20wDQYJKoZIhvcNAQEM
+BQADggIBADoIPZD+zZzMmsZaUIc4WiV5NwHbB5nnmvSaDas20GSsyRiSnQVUwCT6
+RzJJhPGJnoIHL7uYyjZDnYrB4MOL/1c0g+7BFmDY+0/csUwdHlouTOrj17T3nyrR
+JjEg3/bY16ojl91ji4g4XbvB7L2tKkK2kF+dcIECRbcw+vE2gLSv7wcl78+m0jjb
+3nw8Z+bs/R/W7C8kn+6bfgRrI2NGhd2wnJ579xMLUoodj/L2sXokw0/jiDrWgGAd
+MijIVvVFSTaI08/8LReuluxbFCvftNBwiBVZm7UMV3hwZ97dqW+Tq4+Lh9GrbnO/
+tMMSVSib+KKRMDYh5HGfjmmW9UTmaTL23oP7XPNuuOwqy0Z4RGqMWd8JYvNe0XFw
+7rs73SJJN3zccKZvznDSaCzJBCjT3i3JrbbSW1cZKn0RFHhkFZmtP63HiXAo+G0n
+Z7C/INTWdQcy9tJ/tYfC/ZVjap7R2C8s7XO2PR3oBvATgaRFIPF7q7+kyN0qmwfl
+7Kt0O+dFw88fvjKfMIMQtnNqY7bWpGWg0XstM1L4kwi1FFNElCjFJR3rN5kpf5n1
+7LqhsLc296cnFIwf/Yu9FaPkOJiGga6FewBTGqcWj8lL2KgHn95hdky0FzgIKRYw
+loK8Ee0Y9wee43mVaHEdRD11fUQZYXsnXIFFtVXsIFH43LTiYfgN
+-----END CERTIFICATE-----

android/app/src/main/res/xml/network_security_config.xml

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <domain-config>
+        <domain includeSubdomains="false">aggiespirit.ts.tamu.edu</domain>
+        <trust-anchors>
+            <certificates src="system" />
+            <certificates src="@raw/incommon_rsa_ov_ssl_ca3" />
+        </trust-anchors>
+    </domain-config>
+</network-security-config>