title: How to make client certificate authentication from Android 4.1 with Apache client and the KeyChain API
body: <p>Since ICS Android supports unified access to the system keystore and trusted CAs via the KeyChain API. </p>
  
  <p>It is quite nice but is giving me following trouble when I try to use a private key from this source for client cert authentication.</p>
  
  <p>I checked some answers here and the best thing that I found was: <a href="https://stackoverflow.com/questions/11581208/android-4-0-ssl-authentication">Android 4.0 SSL Authentication</a></p>
  
  <p>It refers to 4.0 and provides following coding:</p>
  
  <p>Update - this coding is WRONG - it will not work in 4.1+
  </p>
  
  <pre><code>String alias = "test";
  KeyStore memoryKeyStore = KeyStore.getInstance("BKS");
  memoryKeyStore.load(null);
  X509Certificate[] chain = KeyChain.getCertificateChain(getApplicationContext(),alias);
  PrivateKey key = KeyChain.getPrivateKey(getApplicationContext(),alias);
  memoryKeyStore.setKeyEntry(alias, key.getEncoded(), chain);
  </code></pre>
  
  <p>this is however not working in 4.1 because the PrivateKey object returned by KeyChain.getPrivateKey() returns null when the getEncoded() method is called and the KeyStore cannot be initialized.</p>
  
  <p>Is there any other way to do this in 4.1?</p>
  
  <p>Update - here the correct way to define your own implementation of KeyStore and KeyStoreSpi
  Here the sample implementation of KeyStore and KeyStoreSpi:</p>
  
  <p>KeyStoreSpi implementation:</p>
  
  <pre class="lang-java prettyprint-override"><code>import java.io.IOException;
  import java.io.InputStream;
  import java.io.OutputStream;
  import java.security.Key;
  import java.security.KeyStoreException;
  import java.security.KeyStoreSpi;
  import java.security.NoSuchAlgorithmException;
  import java.security.UnrecoverableKeyException;
  import java.security.cert.Certificate;
  import java.security.cert.CertificateException;
  import java.util.ArrayList;
  import java.util.Collections;
  import java.util.Date;
  import java.util.Enumeration;
  import java.util.List;
  
  import java.security.PrivateKey;
  
  public class KeyChainProxy extends KeyStoreSpi {
  
  
    private String alias = null;
    private PrivateKey privateKey = null;
    private Certificate[] certChain = null;
  
    public KeyChainProxy(String alias, PrivateKey privateKey, Certificate[] certChain) {
      this.alias = alias;
      this.privateKey = privateKey;
      this.certChain = certChain;
    }
  
    @Override
    public Key engineGetKey(String alias, char[] password) throws NoSuchAlgorithmException, UnrecoverableKeyException {
      return privateKey;
    }
  
    @Override
    public Certificate[] engineGetCertificateChain(String alias) {
      return certChain;
    }
  
    @Override
    public Certificate engineGetCertificate(String alias) {
      return certChain[0];
    }
  
    @Override
    public Date engineGetCreationDate(String alias) {
      return new Date();
    }
  
    @Override
    public void engineSetKeyEntry(String alias, Key key, char[] password, Certificate[] chain) throws KeyStoreException {
      throw new KeyStoreException("Not Implemented");
  
    }
  
    @Override
    public void engineSetKeyEntry(String alias, byte[] key, Certificate[] chain) throws KeyStoreException {
      throw new KeyStoreException("Not Implemented");
  
    }
  
    @Override
    public void engineSetCertificateEntry(String alias, Certificate cert) throws KeyStoreException {
      throw new KeyStoreException("Not Implemented");
  
    }
  
    @Override
    public void engineDeleteEntry(String alias) throws KeyStoreException {
      throw new KeyStoreException("Not Implemented");
  
    }
  
    @Override
    public Enumeration&lt;String&gt; engineAliases() {
      List&lt;String&gt; list = new ArrayList&lt;String&gt;();
      list.add(alias);
      return Collections.enumeration(list);
    }
  
    @Override
    public boolean engineContainsAlias(String alias) {
      return alias != null &amp;&amp; alias.equals(this.alias);
    }
  
    @Override
    public int engineSize() {
      return 1;
    }
  
    @Override
    public boolean engineIsKeyEntry(String alias) {
      return true;
    }
  
    @Override
    public boolean engineIsCertificateEntry(String alias) {
      return false;
    }
  
    @Override
    public String engineGetCertificateAlias(Certificate cert) {
      return null;
    }
  
    @Override
    public void engineStore(OutputStream stream, char[] password) throws IOException, NoSuchAlgorithmException, CertificateException {
  
    }
  
    @Override
    public void engineLoad(InputStream stream, char[] password) throws IOException, NoSuchAlgorithmException, CertificateException {
  
    }
  
  }
  </code></pre>
  
  <p>KeyStore implemenation:</p>
  
  <pre><code>import java.security.KeyStore;
  import java.security.KeyStoreSpi;
  import java.security.Provider;
  
  public class KeyChainKeystore extends KeyStore {
  
    public KeyChainKeystore(KeyStoreSpi keyStoreSpi, Provider provider, String type) {
      super(keyStoreSpi, provider, type);
      try {
        load(null, null);
      } catch (Exception e) {
        // ignore - our spi doesn't do anything
      }
    }
  </code></pre>
  
  <p>}</p>
  
  <p>Thank you</p>
  
  <p>Vasil</p>