3.1.1 on Android crashes with NPE when trusting all certificates

// Create a trust manager that does not validate certificate chains
final TrustManager[] trustAllCerts = new TrustManager[] {
        new X509TrustManager() {
            @Override
            public void checkClientTrusted(final X509Certificate[] chain, final String authType) {
            }

            @Override
            public void checkServerTrusted(final X509Certificate[] chain, final String authType) {
            }

            @Override
            public X509Certificate[] getAcceptedIssuers() {
                return null;
            }
        }
};

// Install the all-trusting trust manager
final SSLContext sslContext = SSLContext.getInstance("TLS");
sslContext.init(null, trustAllCerts, new SecureRandom());

final OkHttpClient okHttpClient = new OkHttpClient.Builder()
        .sslSocketFactory(sslContext.getSocketFactory())
        .hostnameVerifier(new HostnameVerifier() {
            @Override
            public boolean verify(final String hostname, final SSLSession session) {
                return true;
            }
        })
        .build();

This crashes with the following stack trace:

Caused by: java.lang.NullPointerException: Attempt to get length of null array
   at okhttp3.internal.tls.RealTrustRootIndex.<init>(RealTrustRootIndex.java:31)
   at okhttp3.internal.Platform.trustRootIndex(Platform.java:97)
   at okhttp3.internal.Platform$Android.trustRootIndex(Platform.java:271)
   at okhttp3.OkHttpClient.<init>(OkHttpClient.java:189)
   at okhttp3.OkHttpClient.<init>(OkHttpClient.java:60)
   at okhttp3.OkHttpClient$Builder.build(OkHttpClient.java:718)

This used to worked with OkHttp 2 and 3.0.1. Now after updating to 3.1.1, our app crashes.

P. S. I know it’s not secure, don’t lecture me. 😉

[swankjesse]

@rmakki does changing getAcceptedIssuers() work?

            @Override
            public X509Certificate[] getAcceptedIssuers() {
                return new X509Certificate[0];
            }

[JakeWharton]

Do not return null from getAcceptedIssuers(), return a zero-length array instead.