droid-mcp-tls/io.droidmcp.tls/SelfSignedCert

SelfSignedCert

Generates (and persists) a self-signed certificate for droid-mcp's HTTPS transport, returning a TlsConfig ready to hand to DroidMcp.Builder.enableTls(...).

Uses BouncyCastle only to build the X.509 certificate — Android's public API has no certificate builder, and AndroidKeyStore won't export a private key for the embedded server to use. Key generation and signing go through the platform providers (Conscrypt), so no security provider is registered.

The keystore is PKCS12, the one keystore type Android's runtime supports (it has no JKS provider). It's persisted so the certificate — and therefore the pinned TlsConfig.certFingerprintSha256 — stays stable across restarts.

The certificate is intentionally minimal: CN=droid-mcp, no SANs. Clients pin the fingerprint rather than validating hostname/chain, so SANs are moot.

Functions

loadOrCreate

fun loadOrCreate(file: File, alias: String = DEFAULT_ALIAS, password: CharArray = DEFAULT_PASSWORD.toCharArray(), httpsPort: Int = 8443, validityDays: Long = 3650): TlsConfig

Load the keystore at file if it exists, otherwise generate a fresh self-signed cert and persist it there.