https over self-signed certificate

[pepie]

'CERTIFICATE_VERIFY_FAILED' exception is thrown, when connection to server with self-signed certificate.

var url = 'https://jsonplaceholder.typicode.com/posts/1';
Dio dio = new Dio();
await dio.get(url).then((response){
  print(response.data);
}).catchError((err){
   print(err);
});

[wendux]

You should create a SecurityContext object to trust your certificate in onHttpClientCreate callback, for examples:

  dio.onHttpClientCreate = (HttpClient client) {
    // create a `SecurityContext` instance to trust you certificate
    return HttpClient(securityContext)
  };

More about SecurityContext please refer to dart doc -SecurityContext

[pepie]

Consider adding support for badCertificateCallback.

 HttpClient httpClient = new HttpClient()
      ..badCertificateCallback =
      ((X509Certificate cert, String host, int port) => trustSelfSigned);

perhaps as an option to the constructor:

new Dio({acceptSelfSignedCert: false})

[pepie]

it doesn't seem like onHttpClientCreate() is ever reached:

    Dio dio = new Dio();
    dio.onHttpClientCreate = (HttpClient client) {
      print('onHttpClientCreate entered...');  // this code is never reached
      client.badCertificateCallback = (X509Certificate cert, String host, int port) => true;
      return client;
    };

   Response<String> response=await dio.get(url);  //CERTIFICATE_VERIFY_FAILED:ok

[wendux]

Are you sure? I have run the code as follows:

    dio.onHttpClientCreate = (HttpClient client) {
      print("dio xxxx");
      client.badCertificateCallback =
          (X509Certificate cert, String host, int port) {
        return true;
      };
    };

Console log

I/flutter (18963): dio xxxx

Which version of dio do you use? 0.1.3?

[pepie]

Yes, It never ran on my box.
It's a little weird.

I've submitted a pull request to support self-signed certs.
#33

Please consider. This works.
Another option would be to allow one to pass the entire callback, instead of setting trustSelfSignedCerts to true.

Great plugin btw!!

[pepie]

@wendux I created a new project and was able to confirm dio.onHttpClientCreate() ran successfully.
I'll have to figure out why it wasn't triggered in the first project, bu the problem seems to be local.

Using version 0.1.3
FYI

[wendux]

@pepie Ok, May you overwrite OnHttpClientCreate callback somewhere ?

[pepie]

I'm guessing that's the case.
I'll send an update if I discover anything strange.
Thanks!

[lyquocnam]

what about this issuse ?

[cdvv7788]

It seems that @pepie found a solution (check #33 ). Should this issue be closed? Does this specific case need to be documented?

From gitme Android

[pepie]

Closing this issue since a solution was found.
class MyHttpOverrides extends HttpOverrides{
@OverRide
HttpClient createHttpClient(SecurityContext context){
HttpClient client= super.createHttpClient(context); //<<--- notice 'super'
client.badCertificateCallback = (X509Certificate cert, String host, int port)=> true;
return client;
}
}

void main(){
HttpOverrides.global = new MyHttpOverrides();
runApp(new App());
}

[anisalibegic]

(dio.httpClientAdapter as DefaultHttpClientAdapter).onHttpClientCreate = (HttpClient client) {
    client.badCertificateCallback = (X509Certificate cert, String host, int port) => true;
    return client;
};

[abgrano]

Dio dio = new Dio();
(dio.httpClientAdapter as DefaultHttpClientAdapter).onHttpClientCreate =
(HttpClient client) {
client.badCertificateCallback =
(X509Certificate cert, String host, int port) => true;
return client;
};

[arnbut]

DioForNative dio = DioForNative();
DefaultHttpClientAdapter httpClient = dio.httpClientAdapter;
httpClient.onHttpClientCreate = (HttpClient client) {
client.badCertificateCallback =
(X509Certificate cert, String host, int port) {
return true;
};
};
and then you can make dio.post and dio.get requests.

[bambinoua]

How to disable SSL certificate check using Dio in WEB ENVIRONMENT?

[LukeDaniel16]

(dio.httpClientAdapter as DefaultHttpClientAdapter).onHttpClientCreate = (HttpClient client) {
    client.badCertificateCallback = (X509Certificate cert, String host, int port) => true;
    return client;
};

This is not SAFE for production versions!

We need other reply to resolve it, anyone?

[zhusupq]

@bambinoua Have you found a solution for flutter web?

[jparsoft]

In my case I needed to use an self signed certificate and the solution was this:

Future<Response> secureRequest(
    String path, {
    method = 'GET',
    Map<String, dynamic>? queryParameters,
    dynamic data,
    Map<String, String>? headers,
  }) async {
    
   // convert my certificate to pem

   // openssl x509 -in client.crt -out client.pem 
   // openssl rsa -in client.key -out clientkey.pem
     

    ByteData dataCRT = await rootBundle.load('assets/ca/client.pem');
    ByteData dataKey = await rootBundle.load('assets/ca/clientkey.pem');

    Dio dio = Dio();
    dio.interceptors.add(_interceptor);
    (dio.httpClientAdapter as DefaultHttpClientAdapter).onHttpClientCreate =
        (client) {
      SecurityContext serverContext = SecurityContext();

      serverContext.useCertificateChainBytes(dataCRT.buffer.asUint8List());
      serverContext.usePrivateKeyBytes(dataKey.buffer.asUint8List());
      // use a new client for add the certificate and accept self signed certificate and return it
      var newClient = HttpClient(context: serverContext);
      newClient.badCertificateCallback =
          (X509Certificate cert, String host, int port) => true;
      return newClient;
    };
    logger.i("secureRequest");
    logger.d("path: $path");

    return await dio.request(path,
        data: data,
        queryParameters: queryParameters,
        options: Options(
          headers: headers,
          method: method,
        ));
  }

[lukas-pierce]

Actual on March 2024:

onHttpClientCreate callback is deprecated. Now you should use createHttpClient and return your own HttpClient instance:

import 'dart:io';
import 'package:dio/dio.dart';
import 'package:dio/io.dart';

Dio createDio({required String baseUrl, bool trustSelfSigned = false}) {
  // initialize dio
  final dio = Dio()
    ..options.baseUrl = baseUrl;

  // allow self-signed certificate
  (dio.httpClientAdapter as IOHttpClientAdapter).createHttpClient = () {
    final client = HttpClient();
    client.badCertificateCallback = (cert, host, port) => trustSelfSigned;
    return client;
  };
  
  return dio;
}