

GooglePlayから以下のメールが届きました。  
作成したアプリは、クラッシュレポート機能を実装しているため『org.acra.』をimportしていますが、  
実際は、『org.acra.util.NaiveTrustManager;』は使用していないにも関わらずが警告されています。  
この場合でも、アプリを変更する必要があるのでしょうか？  
また、どのような対応が必要なのでしょうか？

ご存知の方、ご教授お願いします。

* * *

Google Play warning: You are using an unsafe implementation of
X509TrustManager

Your app(s) listed at the end of this email use an unsafe implementation of
the interface X509TrustManager. Specifically, the implementation ignores all
SSL certificate validation errors when establishing an HTTPS connection to a
remote host, thereby making your app vulnerable to man-in-the-middle attacks.
An attacker could read transmitted data (such as login credentials) and even
change the data transmitted on the HTTPS connection. If you have more than 20
affected apps in your account, please check the Developer Console for a full
list.  
To properly handle SSL certificate validation, change your code in the
checkServerTrusted method of your custom X509TrustManager interface to raise
either CertificateException or IllegalArgumentException whenever the
certificate presented by the server does not meet your expectations. For
technical questions, you can post to Stack Overflow and use the tags “android-
security” and “TrustManager.”  
Please address this issue as soon as possible and increment the version number
of the upgraded APK. Beginning May 17, 2016, Google Play will block publishing
of any new apps or updates containing the unsafe implementation of the
interface X509TrustManager.  
To confirm you’ve made the correct changes, submit the updated version of your
app to the Developer Console and check back after five hours. If the app
hasn’t been correctly upgraded, we will display a warning.

* * *


CC BY-SA 3.0
2016-02-23T02:09:04.967
22412
2016-02-23T02:09:04.967
14508
question
android
X509TrustManagerの警告について