title: How to fix unsafe implementation of X509TrustManager warrning in Android app
body: <p>I am getting security alert on my uploaded Android Build on Google Play Store. </p>
  
  <p>"Your app is using an unsafe implementation of the X509TrustManager interface with an Apache HTTP client, resulting in a security vulnerability. Please see this Google Help Center article for details, including the deadline for fixing the vulnerability."</p>
  
  <p>I try to fix it by implementing following code and update my build </p>
  
  <pre><code>public class MySSLSocketFactory  extends SSLSocketFactory {
      SSLContext sslContext = SSLContext.getInstance("TLS");
  
      public MySSLSocketFactory(KeyStore truststore) throws NoSuchAlgorithmException, KeyManagementException, KeyStoreException, UnrecoverableKeyException {
          super(truststore);
  
          TrustManager tm = new X509TrustManager() {
              public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {
              }
  
              public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
              }
  
              public X509Certificate[] getAcceptedIssuers() {
                  return null;
              }
          };
  
          sslContext.init(null, new TrustManager[] { tm }, null);
      }
  
      @Override
      public Socket createSocket(Socket socket, String host, int port, boolean autoClose) throws IOException, UnknownHostException {
          return sslContext.getSocketFactory().createSocket(socket, host, port, autoClose);
      }
  
      @Override
      public Socket createSocket() throws IOException {
          return sslContext.getSocketFactory().createSocket();
      }
  }
  </code></pre>
  
  <p>But still I am getting security alert. </p>
  
  <p>One more question that I don't want to update my live application again and again to remove this security alert. Is there any way that I can upload my build and can check that changes was done perfectly and can live this same application.</p>
  
  <p>Update: I also add following lines in checkServerTrusted()</p>
  
  <pre><code>try {
      chain[0].checkValidity();
  } catch (CertificateExpiredException e) {
      Logger.e(TAG, "CertificateExpiredException");
      throw new CertificateException("CertificateExpiredException");
  } catch (CertificateNotYetValidException e) {
      Logger.e(TAG, "CertificateNotYetValidException");
      throw new CertificateException("CertificateNotYetValidException");
  }
  </code></pre>