# Android Insecure Certificate Validation

> Detects Android TrustManager implementations that accept all certificates, disabling SSL/TLS security.

- Skill: `zakirkun/android-insecure-certificate-validation` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/android-insecure-certificate-validation`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/android-insecure-certificate-validation/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/android-insecure-certificate-validation

---


# Android Insecure Certificate Validation

## Overview
Android applications that implement custom `X509TrustManager` with empty or no-op validation methods accept any certificate, including self-signed and attacker-controlled certificates. This completely negates TLS security and enables trivial man-in-the-middle attacks.

Common vulnerable pattern: `checkServerTrusted()` method with empty body.

## Detection Strategy
- `X509TrustManager` with empty `checkServerTrusted()`
- `HostnameVerifier` that always returns true
- `setSSLSocketFactory` with custom factory that accepts all certs

## Remediation
- Use the default system TrustManager (trusts only CA-signed certs)
- Implement certificate pinning for sensitive applications using OkHttp `CertificatePinner` or Android Network Security Config
- Use the `networkSecurityConfig` XML for declarative pinning