Play Store Alert - Unsafe Implementation of onReceivedSSLError - ssl

Question

One of my app in the play store has received this alert recently and I am completely lost as to what should be done to stop this alert. Please refer this.
Scenarios in my app:
There's a payment gateway involved in the app but the payment takes place through a webview and I am almost sure that this alert might be a result of those webviews.
Insights from Google :
As far as I've searched, I've come across the OnReceivedSslError more often and even the alert clearly states me to handle that method properly. But I am totally lost cause I haven't implemented that method in the first place.
Deeper surfing lead me to links like this,this and this too. The common thing that I found in all the links is that they were all referring to an older version of android. But I am using my minSDK as 14 which is Android 4.0 and above. So I got lost again. And I presume that this alert comes when we use a https in our webview.
So my questions are
How did I get this issue suddenly ?
This app has been in the play store for more than 6 months and this alert comes out of the blue !!! Absolutely no idea what happened !!
How do I reproduce the issue ?
I have tried many methods to reproduce this issue and I have implemented the SSL method as given in here:But nothing seems to be working.
Will this issue affect my payment or my app in any ways ?
How can I reproduce this issue to know more and how can i stop this alert ?
What have I tried ? :
As I had my doubts in older android versions, I designed an emulator with my minSDK but even in that my flow did not enter the method.
My doubt :
Could there be a not-so-genuine SSL which could've triggered this issue ?
Any ideas and insights on this issue will be much helpful. Thanks in advance. I just need to disable that alert, as simple as that.

Answer 1

It seems that Google has upgraded their security checks when you use WebViewClients. In many cases - no pun intended - developers fix an SSL problem like this:
#Override
public void onReceivedSslError(WebView view, final SslErrorHandler handler, SslError error) {
handler.proceed();
}
I had this issue too, and it seems that Lint doesn't implement this check yet. So it'll be quite difficult to reproduce. If you would like to see what happens, create a self-signed certificate, set-up a webserver using this certificate and connect a webviewclient to this "untrusted" webserver. If you don't handle the onReceivedSSLError, you'll either get an error, or nothing will happen in the webview (by default).
Will it affect your payment? I guess it would, IF the SSL certificate is untrusted, as the request to the url/api will be cancelled.
The above snippet would just ignore the SSL error, and provide the possibility for a MITM-attack. Have you tried intercepting the request, alerting the user, and allowing them to make the choice to continue?
e.g.
#Override
public void onReceivedSslError(WebView view, final SslErrorHandler handler, SslError error) {
//super.onReceivedSslError(view, handler, error);
AlertDialog.Builder builder = new AlertDialog.Builder(GroupsActivity.this);
builder.setTitle("Invalid/Untrusted certificate");
builder.setMessage("You're accessing a page with an untrusted or invalid certificate. Do you want to continue?");
builder.setNegativeButton("Cancel", new OnClickListener() {
#Override
public void onClick(DialogInterface dialog, int which) {
handler.cancel();
Toast.makeText(GroupsActivity.this, "Request cancelled", Toast.LENGTH_LONG).show();
}
});
builder.setPositiveButton("Continue", new OnClickListener() {
#Override
public void onClick(DialogInterface dialog, int which) {
handler.proceed();
}
});
}

Answer 2

To properly handle SSL certificate validation, change your code to invoke handler.proceed() whenever the certificate presented by the server meets your expectations, and invoke handler.cancel() otherwise.
onReceivedSslError() should notify user about error by Alert Dialog.
If you remove onReceivedSslError() then it will call by default handler.cancel() in case of SSL error.This also will work.