Android, Self-Signed Certificates and OkHttp
Just recently I have been writing a private Android application using the latest freshness that is Kotlin . Of course, like all mobile applications, it makes heavy use of HTTP requests, sending data back and forth between my app and the back-end API. Because this app is private, it will never be released in the Google Play store and the back-end server will not be publicly available on the internet. The server is a private home web server on an internal network (think intranet) and the application will only contact it over my home WiFi. Did you know that Sensitive Data Exposure is still on the 2017 OSWASP top 10 list ? It's currently sitting at the #3 spot. The OSWASP folks say: "Over the last few years, this has been the most common impactful attack. The most common flaw is simply not encrypting sensitive data." So, as a good developer, my next job was to switch my project to use HTTPS/TLS . That's when I remembered Let’s Encrypt which is a free , auto