title: Android - How to store certificate in keystore programmatically?
body: <p>I am making a financial transaction android app. It requires SSL authentication and I successfully able to complete it(handshake between Android and Tomcat). I used keytool and openSSL to generate Server and client certificates. Tomcat certifcate format is JKS and android formate is BKS. I stored this BKS file in Raw folder and use this as follows: </p>
  
  <pre><code>public class NetworkCallSecure extends AsyncTask&lt;String, Void, String&gt; {
  
  ResponseListener responseListener;
  Activity activity;
  ResultCodes code;
  
  public NetworkCallSecure(Activity activity, ResponseListener responseListener, ResultCodes code) {
      this.responseListener = responseListener;
      this.activity = activity;
      this.code = code;
  }
  
  @Override
  protected String doInBackground(String... params) {
  
      try{
  
          System.setProperty("http.keepAlive", "false");
          HttpsURLConnection .setDefaultHostnameVerifier(new HostnameVerifier() {
  
                      public boolean verify(String hostname,
                                            SSLSession session) {
                          Log.d("HTTPS",hostname+":"+session);
                          return true;
                      }
                  });
  
          char[] passwKey = "mypass".toCharArray();
          KeyStore ks = KeyStore.getInstance("BKS");
          InputStream in = activity.getResources().openRawResource(
                  R.raw.client);
          InputStream is = activity.getResources().openRawResource(
                  R.raw.client);
          ks.load(in, passwKey);
          KeyManagerFactory kmf = KeyManagerFactory.getInstance("X509");
          kmf.init(ks, passwKey);
  
          SSLContext context = SSLContext.getInstance("TLS");
          context.init(kmf.getKeyManagers(),
                  new X509TrustManager[] { new MyX509TrustManager(is,
                          passwKey) }, new SecureRandom());
          HttpsURLConnection.setDefaultSSLSocketFactory(context
                  .getSocketFactory());
  
          URL url = new URL(params[0]);
  
          HttpsURLConnection connection = (HttpsURLConnection) url
                  .openConnection();
          connection.setRequestMethod("POST");
          connection.setRequestProperty("Content-Type", "application/json");
          connection.setRequestProperty("Content-Length", "" + Integer.toString(params[1].getBytes().length));
          connection.setDoOutput(true);
  
          byte[] outputInBytes = params[1].getBytes("UTF-8");
          OutputStream os = connection.getOutputStream();
          os.write( outputInBytes );
          os.close();
  
          BufferedReader bin = new BufferedReader(new InputStreamReader(
                  connection.getInputStream()));
  
          StringBuffer sb = new StringBuffer();
          String line;
          while ((line = bin.readLine()) != null) {
              sb.append(line);
          }
          in.close();
          is.close();
          return sb.toString();
      } catch (Exception e) { // should never happen
          e.printStackTrace();
          Log.d("Err", e.toString());
      }
      return "no result";
  }
  
  @Override
  protected void onPostExecute(String result) {
      responseListener.getResponse(result,code);
  }
  }
  </code></pre>
  
  <p>My Trustmanager class is:</p>
  
  <pre><code>public class MyX509TrustManager implements X509TrustManager {
  X509TrustManager pkixTrustManager;
  
  public MyX509TrustManager(InputStream trustStore, char[] password)
          throws Exception {
      // create a "default" JSSE X509TrustManager.
  
      KeyStore ks = KeyStore.getInstance("BKS");
  
      ks.load(trustStore, password);
  
      TrustManagerFactory tmf = TrustManagerFactory.getInstance("X509");
      tmf.init(ks);
  
      TrustManager tms[] = tmf.getTrustManagers();
  
      /*
       * Iterate over the returned trustmanagers, look for an instance of
       * X509TrustManager. If found, use that as our "default" trust manager.
       */
      for (int i = 0; i &lt; tms.length; i++) {
          if (tms[i] instanceof X509TrustManager) {
              pkixTrustManager = (X509TrustManager) tms[i];
              return;
          }
      }
  
      /*
       * Find some other way to initialize, or else we have to fail the
       * constructor.
       */
      throw new Exception("Couldn't initialize");
  }
  
  public void checkClientTrusted(X509Certificate[] arg0, String arg1)
          throws CertificateException {
      // TODO Auto-generated method stub
      try {
          pkixTrustManager.checkClientTrusted(arg0, arg1);
      } catch (CertificateException excep) {
          // do any special handling here, or rethrow exception.
      }
  
  }
  
  public void checkServerTrusted(X509Certificate[] arg0, String arg1)
          throws CertificateException {
      // TODO Auto-generated method stub
      try {
          pkixTrustManager.checkServerTrusted(arg0, arg1);
      } catch (CertificateException excep) {
          /*
           * Possibly pop up a dialog box asking whether to trust the cert
           * chain.
           */
      }
  }
  
  public X509Certificate[] getAcceptedIssuers() {
      // TODO Auto-generated method stub
      return pkixTrustManager.getAcceptedIssuers();
  }
  }
  </code></pre>
  
  <p>Now I want to register user using this HTTPS connection. The process is get details from user and send it to server. Server will verify these details and send confirmation PIN on user mobile (got this MSISDN in user details). User will enter this PIN and server will verify that PIN is same. After user is verified client app (user mobile) will generate a CSR and send it to server. Server will generate Certificate using this CSRand send it to client (mobile app).
  <strong>Now my problem is I want to store this certificate where only my App can access this certificate.</strong> I am trying to save this in my BKS file in raw folder using this:</p>
  
  <pre><code>private boolean storeCertInKeystore(byte[] cert) {
      try {
          InputStream is = getResources().openRawResource(
                  R.raw.client);
          CertificateFactory cf = CertificateFactory.getInstance("X.509");
          InputStream certstream = new ByteArrayInputStream(cert);
          X509Certificate certificate = (X509Certificate) cf.generateCertificate(certstream);
          KeyStore keyStore = KeyStore.getInstance("BKS");
          keyStore.load(is, "mypass".toCharArray());
          keyStore.setCertificateEntry("mycert", certificate);
  
  
          Log.d("My App Cert: ", "true");
          return true;
      } catch(Exception e) {
              e.printStackTrace();
      }
      return false;
  }
  </code></pre>
  
  <p>This code runs successfully but could not store cert in BKS file. I tried another way describe <a href="http://www.java2s.com/Tutorial/Java/0490__Security/AddingaCertificatetoaKeyStore.htm" rel="nofollow">here</a> but could not succeed. (I want to use this certificate later in my app for client authentication)
  My Question is Q. How can I store this certificate so it can be only accessible by my app? And also I can delete this certificate when user registration expires.</p>
  
  <p>Please help and thanks in advance.</p>