Feature request: read the server certificate from a TLS rawSocket

Feedback Feature Requests
1

Request: expose the certificate the server presented on a TLS interfaces.rawSocket connection (signature for illustration):

String getPeerCertificate()    // PEM of the server's leaf certificate, null before the handshake completes

Use case: bridge-free Google TV / Android TV control. The TV's remote protocol runs over TLS with a client certificate, and pairing hashes the TV's RSA public key with the code shown on screen, so the driver needs the TV's certificate.

The rest of the protocol works in a driver today (2.5.2.138, C-7, against a real Android TV box): client-certificate TLS, RSA key generation, a self-signed certificate built in the driver, pairing, and the remote session. The TV's certificate is currently read from a hand-built TLS 1.2 ClientHello sent over a plain socket, where the Certificate message comes back in the clear. Under TLS 1.3 it is encrypted, so this stops working once a TV refuses TLS 1.2.

Related rawSocket behaviour:

  1. certificate and privateKey without caCertificate make connect() throw NullPointerException. With ignoreSSLIssues: true any PEM certificate works there, so it's a placeholder. Could it be optional?
  2. When the server rejects the handshake, socketStatus() is called about every 6 ms with the same "Connection has closed" error until close().
  3. With no tlsVersion, the socket negotiates TLS 1.2 with a server that offers 1.3. httpGet and asynchttpGet negotiate 1.3 with a server offering both.
  4. When a TLS server closes the connection cleanly, socketStatus() is not called and parse() stops; a driver needs its own idle timer.
  5. close() called from inside parse() logs java.lang.RuntimeException: java.lang.InterruptedException (method socketStatus) as an error, with no line number, even when the driver's socketStatus catches all exceptions. A close scheduled with runInMillis avoids it on an established session, but not after the server has rejected a pairing code.

@gopher.ny for your consideration.

1 Like