Add m-esr52 at 52.6.0

17 files changed, 2549 insertions, 0 deletions

diff --git a/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/AbstractVerifier.java b/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/AbstractVerifier.java
new file mode 100644
index 000000000..24a7b40a8
--- /dev/null
+++ b/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/AbstractVerifier.java
@@ -0,0 +1,386 @@
+/*
+ * ====================================================================
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ * ====================================================================
+ *
+ * This software consists of voluntary contributions made by many
+ * individuals on behalf of the Apache Software Foundation.  For more
+ * information on the Apache Software Foundation, please see
+ * <http://www.apache.org/>.
+ *
+ */
+
+package ch.boye.httpclientandroidlib.conn.ssl;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.net.InetAddress;
+import java.net.UnknownHostException;
+import java.security.cert.Certificate;
+import java.security.cert.CertificateParsingException;
+import java.security.cert.X509Certificate;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.Iterator;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Locale;
+import java.util.NoSuchElementException;
+
+import javax.net.ssl.SSLException;
+import javax.net.ssl.SSLSession;
+import javax.net.ssl.SSLSocket;
+
+import ch.boye.httpclientandroidlib.androidextra.HttpClientAndroidLog;
+/* LogFactory removed by HttpClient for Android script. */
+import ch.boye.httpclientandroidlib.annotation.Immutable;
+import ch.boye.httpclientandroidlib.conn.util.InetAddressUtils;
+import ch.boye.httpclientandroidlib.util.TextUtils;
+
+import ch.boye.httpclientandroidlib.NameValuePair;
+
+
+/**
+ * Abstract base class for all standard {@link X509HostnameVerifier}
+ * implementations.
+ *
+ * @since 4.0
+ */
+@Immutable
+public abstract class AbstractVerifier implements X509HostnameVerifier {
+
+    /**
+     * This contains a list of 2nd-level domains that aren't allowed to
+     * have wildcards when combined with country-codes.
+     * For example: [*.co.uk].
+     * <p/>
+     * The [*.co.uk] problem is an interesting one.  Should we just hope
+     * that CA's would never foolishly allow such a certificate to happen?
+     * Looks like we're the only implementation guarding against this.
+     * Firefox, Curl, Sun Java 1.4, 5, 6 don't bother with this check.
+     */
+    private final static String[] BAD_COUNTRY_2LDS =
+          { "ac", "co", "com", "ed", "edu", "go", "gouv", "gov", "info",
+            "lg", "ne", "net", "or", "org" };
+
+    static {
+        // Just in case developer forgot to manually sort the array.  :-)
+        Arrays.sort(BAD_COUNTRY_2LDS);
+    }
+
+    public HttpClientAndroidLog log = new HttpClientAndroidLog(getClass());
+
+    public AbstractVerifier() {
+        super();
+    }
+
+    public final void verify(final String host, final SSLSocket ssl)
+          throws IOException {
+        if(host == null) {
+            throw new NullPointerException("host to verify is null");
+        }
+
+        SSLSession session = ssl.getSession();
+        if(session == null) {
+            // In our experience this only happens under IBM 1.4.x when
+            // spurious (unrelated) certificates show up in the server'
+            // chain.  Hopefully this will unearth the real problem:
+            final InputStream in = ssl.getInputStream();
+            in.available();
+            /*
+              If you're looking at the 2 lines of code above because
+              you're running into a problem, you probably have two
+              options:
+
+                #1.  Clean up the certificate chain that your server
+                     is presenting (e.g. edit "/etc/apache2/server.crt"
+                     or wherever it is your server's certificate chain
+                     is defined).
+
+                                           OR
+
+                #2.   Upgrade to an IBM 1.5.x or greater JVM, or switch
+                      to a non-IBM JVM.
+            */
+
+            // If ssl.getInputStream().available() didn't cause an
+            // exception, maybe at least now the session is available?
+            session = ssl.getSession();
+            if(session == null) {
+                // If it's still null, probably a startHandshake() will
+                // unearth the real problem.
+                ssl.startHandshake();
+
+                // Okay, if we still haven't managed to cause an exception,
+                // might as well go for the NPE.  Or maybe we're okay now?
+                session = ssl.getSession();
+            }
+        }
+
+        final Certificate[] certs = session.getPeerCertificates();
+        final X509Certificate x509 = (X509Certificate) certs[0];
+        verify(host, x509);
+    }
+
+    public final boolean verify(final String host, final SSLSession session) {
+        try {
+            final Certificate[] certs = session.getPeerCertificates();
+            final X509Certificate x509 = (X509Certificate) certs[0];
+            verify(host, x509);
+            return true;
+        }
+        catch(final SSLException e) {
+            return false;
+        }
+    }
+
+    public final void verify(final String host, final X509Certificate cert)
+          throws SSLException {
+        final String[] cns = getCNs(cert);
+        final String[] subjectAlts = getSubjectAlts(cert, host);
+        verify(host, cns, subjectAlts);
+    }
+
+    public final void verify(final String host, final String[] cns,
+                             final String[] subjectAlts,
+                             final boolean strictWithSubDomains)
+          throws SSLException {
+
+        // Build the list of names we're going to check.  Our DEFAULT and
+        // STRICT implementations of the HostnameVerifier only use the
+        // first CN provided.  All other CNs are ignored.
+        // (Firefox, wget, curl, Sun Java 1.4, 5, 6 all work this way).
+        final LinkedList<String> names = new LinkedList<String>();
+        if(cns != null && cns.length > 0 && cns[0] != null) {
+            names.add(cns[0]);
+        }
+        if(subjectAlts != null) {
+            for (final String subjectAlt : subjectAlts) {
+                if (subjectAlt != null) {
+                    names.add(subjectAlt);
+                }
+            }
+        }
+
+        if(names.isEmpty()) {
+            final String msg = "Certificate for <" + host + "> doesn't contain CN or DNS subjectAlt";
+            throw new SSLException(msg);
+        }
+
+        // StringBuilder for building the error message.
+        final StringBuilder buf = new StringBuilder();
+
+        // We're can be case-insensitive when comparing the host we used to
+        // establish the socket to the hostname in the certificate.
+        final String hostName = normaliseIPv6Address(host.trim().toLowerCase(Locale.ENGLISH));
+        boolean match = false;
+        for(final Iterator<String> it = names.iterator(); it.hasNext();) {
+            // Don't trim the CN, though!
+            String cn = it.next();
+            cn = cn.toLowerCase(Locale.ENGLISH);
+            // Store CN in StringBuilder in case we need to report an error.
+            buf.append(" <");
+            buf.append(cn);
+            buf.append('>');
+            if(it.hasNext()) {
+                buf.append(" OR");
+            }
+
+            // The CN better have at least two dots if it wants wildcard
+            // action.  It also can't be [*.co.uk] or [*.co.jp] or
+            // [*.org.uk], etc...
+            final String parts[] = cn.split("\\.");
+            final boolean doWildcard =
+                    parts.length >= 3 && parts[0].endsWith("*") &&
+                    validCountryWildcard(cn) && !isIPAddress(host);
+
+            if(doWildcard) {
+                final String firstpart = parts[0];
+                if (firstpart.length() > 1) { // e.g. server*
+                    final String prefix = firstpart.substring(0, firstpart.length() - 1); // e.g. server
+                    final String suffix = cn.substring(firstpart.length()); // skip wildcard part from cn
+                    final String hostSuffix = hostName.substring(prefix.length()); // skip wildcard part from host
+                    match = hostName.startsWith(prefix) && hostSuffix.endsWith(suffix);
+                } else {
+                    match = hostName.endsWith(cn.substring(1));
+                }
+                if(match && strictWithSubDomains) {
+                    // If we're in strict mode, then [*.foo.com] is not
+                    // allowed to match [a.b.foo.com]
+                    match = countDots(hostName) == countDots(cn);
+                }
+            } else {
+                match = hostName.equals(normaliseIPv6Address(cn));
+            }
+            if(match) {
+                break;
+            }
+        }
+        if(!match) {
+            throw new SSLException("hostname in certificate didn't match: <" + host + "> !=" + buf);
+        }
+    }
+
+    /**
+     * @deprecated (4.3.1) should not be a part of public APIs.
+     */
+    @Deprecated
+    public static boolean acceptableCountryWildcard(final String cn) {
+        final String parts[] = cn.split("\\.");
+        if (parts.length != 3 || parts[2].length() != 2) {
+            return true; // it's not an attempt to wildcard a 2TLD within a country code
+        }
+        return Arrays.binarySearch(BAD_COUNTRY_2LDS, parts[1]) < 0;
+    }
+
+    boolean validCountryWildcard(final String cn) {
+        final String parts[] = cn.split("\\.");
+        if (parts.length != 3 || parts[2].length() != 2) {
+            return true; // it's not an attempt to wildcard a 2TLD within a country code
+        }
+        return Arrays.binarySearch(BAD_COUNTRY_2LDS, parts[1]) < 0;
+    }
+
+    public static String[] getCNs(final X509Certificate cert) {
+        final String subjectPrincipal = cert.getSubjectX500Principal().toString();
+        try {
+            return extractCNs(subjectPrincipal);
+        } catch (SSLException ex) {
+            return null;
+        }
+    }
+
+    static String[] extractCNs(final String subjectPrincipal) throws SSLException {
+        if (subjectPrincipal == null) {
+            return null;
+        }
+        final List<String> cns = new ArrayList<String>();
+        final List<NameValuePair> nvps = DistinguishedNameParser.INSTANCE.parse(subjectPrincipal);
+        for (int i = 0; i < nvps.size(); i++) {
+            final NameValuePair nvp = nvps.get(i);
+            final String attribName = nvp.getName();
+            final String attribValue = nvp.getValue();
+            if (TextUtils.isBlank(attribValue)) {
+                throw new SSLException(subjectPrincipal + " is not a valid X500 distinguished name");
+            }
+            if (attribName.equalsIgnoreCase("cn")) {
+                cns.add(attribValue);
+            }
+        }
+        return cns.isEmpty() ? null : cns.toArray(new String[ cns.size() ]);
+    }
+
+    /**
+     * Extracts the array of SubjectAlt DNS or IP names from an X509Certificate.
+     * Returns null if there aren't any.
+     *
+     * @param cert X509Certificate
+     * @param hostname
+     * @return Array of SubjectALT DNS or IP names stored in the certificate.
+     */
+    private static String[] getSubjectAlts(
+            final X509Certificate cert, final String hostname) {
+        final int subjectType;
+        if (isIPAddress(hostname)) {
+            subjectType = 7;
+        } else {
+            subjectType = 2;
+        }
+
+        final LinkedList<String> subjectAltList = new LinkedList<String>();
+        Collection<List<?>> c = null;
+        try {
+            c = cert.getSubjectAlternativeNames();
+        }
+        catch(final CertificateParsingException cpe) {
+        }
+        if(c != null) {
+            for (final List<?> aC : c) {
+                final List<?> list = aC;
+                final int type = ((Integer) list.get(0)).intValue();
+                if (type == subjectType) {
+                    final String s = (String) list.get(1);
+                    subjectAltList.add(s);
+                }
+            }
+        }
+        if(!subjectAltList.isEmpty()) {
+            final String[] subjectAlts = new String[subjectAltList.size()];
+            subjectAltList.toArray(subjectAlts);
+            return subjectAlts;
+        } else {
+            return null;
+        }
+    }
+
+    /**
+     * Extracts the array of SubjectAlt DNS names from an X509Certificate.
+     * Returns null if there aren't any.
+     * <p/>
+     * Note:  Java doesn't appear able to extract international characters
+     * from the SubjectAlts.  It can only extract international characters
+     * from the CN field.
+     * <p/>
+     * (Or maybe the version of OpenSSL I'm using to test isn't storing the
+     * international characters correctly in the SubjectAlts?).
+     *
+     * @param cert X509Certificate
+     * @return Array of SubjectALT DNS names stored in the certificate.
+     */
+    public static String[] getDNSSubjectAlts(final X509Certificate cert) {
+        return getSubjectAlts(cert, null);
+    }
+
+    /**
+     * Counts the number of dots "." in a string.
+     * @param s  string to count dots from
+     * @return  number of dots
+     */
+    public static int countDots(final String s) {
+        int count = 0;
+        for(int i = 0; i < s.length(); i++) {
+            if(s.charAt(i) == '.') {
+                count++;
+            }
+        }
+        return count;
+    }
+
+    private static boolean isIPAddress(final String hostname) {
+        return hostname != null &&
+            (InetAddressUtils.isIPv4Address(hostname) ||
+                    InetAddressUtils.isIPv6Address(hostname));
+    }
+
+    /*
+     * Check if hostname is IPv6, and if so, convert to standard format.
+     */
+    private String normaliseIPv6Address(final String hostname) {
+        if (hostname == null || !InetAddressUtils.isIPv6Address(hostname)) {
+            return hostname;
+        }
+        try {
+            final InetAddress inetAddress = InetAddress.getByName(hostname);
+            return inetAddress.getHostAddress();
+        } catch (final UnknownHostException uhe) { // Should not happen, because we check for IPv6 address above
+            log.error("Unexpected error converting "+hostname, uhe);
+            return hostname;
+        }
+    }
+}
diff --git a/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/AllowAllHostnameVerifier.java b/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/AllowAllHostnameVerifier.java
new file mode 100644
index 000000000..8ca1fad5a
--- /dev/null
+++ b/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/AllowAllHostnameVerifier.java
@@ -0,0 +1,54 @@
+/*
+ * ====================================================================
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ * ====================================================================
+ *
+ * This software consists of voluntary contributions made by many
+ * individuals on behalf of the Apache Software Foundation.  For more
+ * information on the Apache Software Foundation, please see
+ * <http://www.apache.org/>.
+ *
+ */
+
+package ch.boye.httpclientandroidlib.conn.ssl;
+
+import ch.boye.httpclientandroidlib.annotation.Immutable;
+
+/**
+ * The ALLOW_ALL HostnameVerifier essentially turns hostname verification
+ * off. This implementation is a no-op, and never throws the SSLException.
+ *
+ *
+ * @since 4.0
+ */
+@Immutable
+public class AllowAllHostnameVerifier extends AbstractVerifier {
+
+    public final void verify(
+            final String host,
+            final String[] cns,
+            final String[] subjectAlts) {
+        // Allow everything - so never blowup.
+    }
+
+    @Override
+    public final String toString() {
+        return "ALLOW_ALL";
+    }
+
+}
diff --git a/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/BrowserCompatHostnameVerifier.java b/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/BrowserCompatHostnameVerifier.java
new file mode 100644
index 000000000..05f7d8c8c
--- /dev/null
+++ b/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/BrowserCompatHostnameVerifier.java
@@ -0,0 +1,67 @@
+/*
+ * ====================================================================
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ * ====================================================================
+ *
+ * This software consists of voluntary contributions made by many
+ * individuals on behalf of the Apache Software Foundation.  For more
+ * information on the Apache Software Foundation, please see
+ * <http://www.apache.org/>.
+ *
+ */
+
+package ch.boye.httpclientandroidlib.conn.ssl;
+
+import javax.net.ssl.SSLException;
+
+import ch.boye.httpclientandroidlib.annotation.Immutable;
+
+/**
+ * The HostnameVerifier that works the same way as Curl and Firefox.
+ * <p/>
+ * The hostname must match either the first CN, or any of the subject-alts.
+ * A wildcard can occur in the CN, and in any of the subject-alts.
+ * <p/>
+ * The only difference between BROWSER_COMPATIBLE and STRICT is that a wildcard
+ * (such as "*.foo.com") with BROWSER_COMPATIBLE matches all subdomains,
+ * including "a.b.foo.com".
+ *
+ *
+ * @since 4.0
+ */
+@Immutable
+public class BrowserCompatHostnameVerifier extends AbstractVerifier {
+
+    public final void verify(
+            final String host,
+            final String[] cns,
+            final String[] subjectAlts) throws SSLException {
+        verify(host, cns, subjectAlts, false);
+    }
+
+    @Override
+    boolean validCountryWildcard(final String cn) {
+        return true;
+    }
+
+    @Override
+    public final String toString() {
+        return "BROWSER_COMPATIBLE";
+    }
+
+}
diff --git a/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/DistinguishedNameParser.java b/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/DistinguishedNameParser.java
new file mode 100644
index 000000000..98b2ec3a9
--- /dev/null
+++ b/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/DistinguishedNameParser.java
@@ -0,0 +1,131 @@
+/*
+ * ====================================================================
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ * ====================================================================
+ *
+ * This software consists of voluntary contributions made by many
+ * individuals on behalf of the Apache Software Foundation.  For more
+ * information on the Apache Software Foundation, please see
+ * <http://www.apache.org/>.
+ *
+ */
+
+package ch.boye.httpclientandroidlib.conn.ssl;
+
+import java.util.ArrayList;
+import java.util.BitSet;
+import java.util.List;
+
+import ch.boye.httpclientandroidlib.NameValuePair;
+import ch.boye.httpclientandroidlib.annotation.Immutable;
+import ch.boye.httpclientandroidlib.message.BasicNameValuePair;
+import ch.boye.httpclientandroidlib.message.ParserCursor;
+import ch.boye.httpclientandroidlib.util.CharArrayBuffer;
+
+@Immutable
+final class DistinguishedNameParser {
+
+    public final static DistinguishedNameParser INSTANCE = new DistinguishedNameParser();
+
+    private static final BitSet EQUAL_OR_COMMA_OR_PLUS      = TokenParser.INIT_BITSET('=', ',', '+');
+    private static final BitSet COMMA_OR_PLUS               = TokenParser.INIT_BITSET(',', '+');
+
+    private final TokenParser tokenParser;
+
+    DistinguishedNameParser() {
+        this.tokenParser = new InternalTokenParser();
+    }
+
+    String parseToken(final CharArrayBuffer buf, final ParserCursor cursor, final BitSet delimiters) {
+        return tokenParser.parseToken(buf, cursor, delimiters);
+    }
+
+    String parseValue(final CharArrayBuffer buf, final ParserCursor cursor, final BitSet delimiters) {
+        return tokenParser.parseValue(buf, cursor, delimiters);
+    }
+
+    NameValuePair parseParameter(final CharArrayBuffer buf, final ParserCursor cursor) {
+        final String name = parseToken(buf, cursor, EQUAL_OR_COMMA_OR_PLUS);
+        if (cursor.atEnd()) {
+            return new BasicNameValuePair(name, null);
+        }
+        final int delim = buf.charAt(cursor.getPos());
+        cursor.updatePos(cursor.getPos() + 1);
+        if (delim == ',') {
+            return new BasicNameValuePair(name, null);
+        }
+        final String value = parseValue(buf, cursor, COMMA_OR_PLUS);
+        if (!cursor.atEnd()) {
+            cursor.updatePos(cursor.getPos() + 1);
+        }
+        return new BasicNameValuePair(name, value);
+    }
+
+    public List<NameValuePair> parse(final CharArrayBuffer buf, final ParserCursor cursor) {
+        final List<NameValuePair> params = new ArrayList<NameValuePair>();
+        tokenParser.skipWhiteSpace(buf, cursor);
+        while (!cursor.atEnd()) {
+            final NameValuePair param = parseParameter(buf, cursor);
+            params.add(param);
+        }
+        return params;
+    }
+
+    public List<NameValuePair> parse(final String s) {
+        if (s == null) {
+            return null;
+        }
+        final CharArrayBuffer buffer = new CharArrayBuffer(s.length());
+        buffer.append(s);
+        final ParserCursor cursor = new ParserCursor(0, s.length());
+        return parse(buffer, cursor);
+    }
+
+    static class InternalTokenParser extends TokenParser {
+
+        @Override
+        public void copyUnquotedContent(
+                final CharArrayBuffer buf,
+                final ParserCursor cursor,
+                final BitSet delimiters,
+                final StringBuilder dst) {
+            int pos = cursor.getPos();
+            final int indexFrom = cursor.getPos();
+            final int indexTo = cursor.getUpperBound();
+            boolean escaped = false;
+            for (int i = indexFrom; i < indexTo; i++, pos++) {
+                final char current = buf.charAt(i);
+                if (escaped) {
+                    dst.append(current);
+                    escaped = false;
+                } else {
+                    if ((delimiters != null && delimiters.get(current))
+                            || TokenParser.isWhitespace(current) || current == '\"') {
+                        break;
+                    } else if (current == '\\') {
+                        escaped = true;
+                    } else {
+                        dst.append(current);
+                    }
+                }
+            }
+            cursor.updatePos(pos);
+        }
+    }
+
+}
diff --git a/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/PrivateKeyDetails.java b/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/PrivateKeyDetails.java
new file mode 100644
index 000000000..c85978550
--- /dev/null
+++ b/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/PrivateKeyDetails.java
@@ -0,0 +1,63 @@
+/*
+ * ====================================================================
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ * ====================================================================
+ *
+ * This software consists of voluntary contributions made by many
+ * individuals on behalf of the Apache Software Foundation.  For more
+ * information on the Apache Software Foundation, please see
+ * <http://www.apache.org/>.
+ *
+ */
+package ch.boye.httpclientandroidlib.conn.ssl;
+
+import ch.boye.httpclientandroidlib.util.Args;
+
+import java.security.cert.X509Certificate;
+import java.util.Arrays;
+
+/**
+ * Private key details.
+ *
+ * @since 4.3
+ */
+public final class PrivateKeyDetails {
+
+    private final String type;
+    private final X509Certificate[] certChain;
+
+    public PrivateKeyDetails(final String type, final X509Certificate[] certChain) {
+        super();
+        this.type = Args.notNull(type, "Private key type");
+        this.certChain = certChain;
+    }
+
+    public String getType() {
+        return type;
+    }
+
+    public X509Certificate[] getCertChain() {
+        return certChain;
+    }
+
+    @Override
+    public String toString() {
+        return type + ':' + Arrays.toString(certChain);
+    }
+
+}
diff --git a/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/PrivateKeyStrategy.java b/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/PrivateKeyStrategy.java
new file mode 100644
index 000000000..ba3ba40c5
--- /dev/null
+++ b/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/PrivateKeyStrategy.java
@@ -0,0 +1,44 @@
+/*
+ * ====================================================================
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ * ====================================================================
+ *
+ * This software consists of voluntary contributions made by many
+ * individuals on behalf of the Apache Software Foundation.  For more
+ * information on the Apache Software Foundation, please see
+ * <http://www.apache.org/>.
+ *
+ */
+package ch.boye.httpclientandroidlib.conn.ssl;
+
+import java.net.Socket;
+import java.util.Map;
+
+/**
+ * A strategy allowing for a choice of an alias during SSL authentication.
+ *
+ * @since 4.3
+ */
+public interface PrivateKeyStrategy {
+
+    /**
+     * Determines what key material to use for SSL authentication.
+     */
+    String chooseAlias(Map<String, PrivateKeyDetails> aliases, Socket socket);
+
+}
diff --git a/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/SSLConnectionSocketFactory.java b/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/SSLConnectionSocketFactory.java
new file mode 100644
index 000000000..341fbe385
--- /dev/null
+++ b/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/SSLConnectionSocketFactory.java
@@ -0,0 +1,295 @@
+/*
+ * ====================================================================
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ * ====================================================================
+ *
+ * This software consists of voluntary contributions made by many
+ * individuals on behalf of the Apache Software Foundation.  For more
+ * information on the Apache Software Foundation, please see
+ * <http://www.apache.org/>.
+ *
+ */
+
+package ch.boye.httpclientandroidlib.conn.ssl;
+
+import ch.boye.httpclientandroidlib.HttpHost;
+import ch.boye.httpclientandroidlib.annotation.ThreadSafe;
+import ch.boye.httpclientandroidlib.conn.socket.LayeredConnectionSocketFactory;
+import ch.boye.httpclientandroidlib.protocol.HttpContext;
+import ch.boye.httpclientandroidlib.util.Args;
+import ch.boye.httpclientandroidlib.util.TextUtils;
+
+import javax.net.SocketFactory;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLSocket;
+import java.io.IOException;
+import java.net.InetSocketAddress;
+import java.net.Socket;
+
+/**
+ * Layered socket factory for TLS/SSL connections.
+ * <p>
+ * SSLSocketFactory can be used to validate the identity of the HTTPS server against a list of
+ * trusted certificates and to authenticate to the HTTPS server using a private key.
+ * <p>
+ * SSLSocketFactory will enable server authentication when supplied with
+ * a {@link java.security.KeyStore trust-store} file containing one or several trusted certificates. The client
+ * secure socket will reject the connection during the SSL session handshake if the target HTTPS
+ * server attempts to authenticate itself with a non-trusted certificate.
+ * <p>
+ * Use JDK keytool utility to import a trusted certificate and generate a trust-store file:
+ *    <pre>
+ *     keytool -import -alias "my server cert" -file server.crt -keystore my.truststore
+ *    </pre>
+ * <p>
+ * In special cases the standard trust verification process can be bypassed by using a custom
+ * {@link ch.boye.httpclientandroidlib.conn.ssl.TrustStrategy}. This interface is primarily intended for allowing self-signed
+ * certificates to be accepted as trusted without having to add them to the trust-store file.
+ * <p>
+ * SSLSocketFactory will enable client authentication when supplied with
+ * a {@link java.security.KeyStore key-store} file containing a private key/public certificate
+ * pair. The client secure socket will use the private key to authenticate
+ * itself to the target HTTPS server during the SSL session handshake if
+ * requested to do so by the server.
+ * The target HTTPS server will in its turn verify the certificate presented
+ * by the client in order to establish client's authenticity.
+ * <p>
+ * Use the following sequence of actions to generate a key-store file
+ * </p>
+ *   <ul>
+ *     <li>
+ *      <p>
+ *      Use JDK keytool utility to generate a new key
+ *      <pre>keytool -genkey -v -alias "my client key" -validity 365 -keystore my.keystore</pre>
+ *      For simplicity use the same password for the key as that of the key-store
+ *      </p>
+ *     </li>
+ *     <li>
+ *      <p>
+ *      Issue a certificate signing request (CSR)
+ *      <pre>keytool -certreq -alias "my client key" -file mycertreq.csr -keystore my.keystore</pre>
+ *     </p>
+ *     </li>
+ *     <li>
+ *      <p>
+ *      Send the certificate request to the trusted Certificate Authority for signature.
+ *      One may choose to act as her own CA and sign the certificate request using a PKI
+ *      tool, such as OpenSSL.
+ *      </p>
+ *     </li>
+ *     <li>
+ *      <p>
+ *       Import the trusted CA root certificate
+ *       <pre>keytool -import -alias "my trusted ca" -file caroot.crt -keystore my.keystore</pre>
+ *      </p>
+ *     </li>
+ *     <li>
+ *      <p>
+ *       Import the PKCS#7 file containg the complete certificate chain
+ *       <pre>keytool -import -alias "my client key" -file mycert.p7 -keystore my.keystore</pre>
+ *      </p>
+ *     </li>
+ *     <li>
+ *      <p>
+ *       Verify the content the resultant keystore file
+ *       <pre>keytool -list -v -keystore my.keystore</pre>
+ *      </p>
+ *     </li>
+ *   </ul>
+ *
+ * @since 4.0
+ */
+@ThreadSafe
+public class SSLConnectionSocketFactory implements LayeredConnectionSocketFactory {
+
+    public static final String TLS   = "TLS";
+    public static final String SSL   = "SSL";
+    public static final String SSLV2 = "SSLv2";
+
+    public static final X509HostnameVerifier ALLOW_ALL_HOSTNAME_VERIFIER
+        = new AllowAllHostnameVerifier();
+
+    public static final X509HostnameVerifier BROWSER_COMPATIBLE_HOSTNAME_VERIFIER
+        = new BrowserCompatHostnameVerifier();
+
+    public static final X509HostnameVerifier STRICT_HOSTNAME_VERIFIER
+        = new StrictHostnameVerifier();
+
+    /**
+     * Obtains default SSL socket factory with an SSL context based on the standard JSSE
+     * trust material (<code>cacerts</code> file in the security properties directory).
+     * System properties are not taken into consideration.
+     *
+     * @return default SSL socket factory
+     */
+    public static SSLConnectionSocketFactory getSocketFactory() throws SSLInitializationException {
+        return new SSLConnectionSocketFactory(
+            SSLContexts.createDefault(),
+            BROWSER_COMPATIBLE_HOSTNAME_VERIFIER);
+    }
+
+    private static String[] split(final String s) {
+        if (TextUtils.isBlank(s)) {
+            return null;
+        }
+        return s.split(" *, *");
+    }
+
+    /**
+     * Obtains default SSL socket factory with an SSL context based on system properties
+     * as described in
+     * <a href="http://docs.oracle.com/javase/1.5.0/docs/guide/security/jsse/JSSERefGuide.html">
+     * "JavaTM Secure Socket Extension (JSSE) Reference Guide for the JavaTM 2 Platform
+     * Standard Edition 5</a>
+     *
+     * @return default system SSL socket factory
+     */
+    public static SSLConnectionSocketFactory getSystemSocketFactory() throws SSLInitializationException {
+        return new SSLConnectionSocketFactory(
+            (javax.net.ssl.SSLSocketFactory) javax.net.ssl.SSLSocketFactory.getDefault(),
+            split(System.getProperty("https.protocols")),
+            split(System.getProperty("https.cipherSuites")),
+            BROWSER_COMPATIBLE_HOSTNAME_VERIFIER);
+    }
+
+    private final javax.net.ssl.SSLSocketFactory socketfactory;
+    private final X509HostnameVerifier hostnameVerifier;
+    private final String[] supportedProtocols;
+    private final String[] supportedCipherSuites;
+
+    public SSLConnectionSocketFactory(final SSLContext sslContext) {
+        this(sslContext, BROWSER_COMPATIBLE_HOSTNAME_VERIFIER);
+    }
+
+    public SSLConnectionSocketFactory(
+            final SSLContext sslContext, final X509HostnameVerifier hostnameVerifier) {
+        this(Args.notNull(sslContext, "SSL context").getSocketFactory(),
+                null, null, hostnameVerifier);
+    }
+
+    public SSLConnectionSocketFactory(
+            final SSLContext sslContext,
+            final String[] supportedProtocols,
+            final String[] supportedCipherSuites,
+            final X509HostnameVerifier hostnameVerifier) {
+        this(Args.notNull(sslContext, "SSL context").getSocketFactory(),
+                supportedProtocols, supportedCipherSuites, hostnameVerifier);
+    }
+
+    public SSLConnectionSocketFactory(
+            final javax.net.ssl.SSLSocketFactory socketfactory,
+            final X509HostnameVerifier hostnameVerifier) {
+        this(socketfactory, null, null, hostnameVerifier);
+    }
+
+    public SSLConnectionSocketFactory(
+            final javax.net.ssl.SSLSocketFactory socketfactory,
+            final String[] supportedProtocols,
+            final String[] supportedCipherSuites,
+            final X509HostnameVerifier hostnameVerifier) {
+        this.socketfactory = Args.notNull(socketfactory, "SSL socket factory");
+        this.supportedProtocols = supportedProtocols;
+        this.supportedCipherSuites = supportedCipherSuites;
+        this.hostnameVerifier = hostnameVerifier != null ? hostnameVerifier : BROWSER_COMPATIBLE_HOSTNAME_VERIFIER;
+    }
+
+    /**
+     * Performs any custom initialization for a newly created SSLSocket
+     * (before the SSL handshake happens).
+     *
+     * The default implementation is a no-op, but could be overridden to, e.g.,
+     * call {@link javax.net.ssl.SSLSocket#setEnabledCipherSuites(String[])}.
+     */
+    protected void prepareSocket(final SSLSocket socket) throws IOException {
+    }
+
+    public Socket createSocket(final HttpContext context) throws IOException {
+        return SocketFactory.getDefault().createSocket();
+    }
+
+    public Socket connectSocket(
+            final int connectTimeout,
+            final Socket socket,
+            final HttpHost host,
+            final InetSocketAddress remoteAddress,
+            final InetSocketAddress localAddress,
+            final HttpContext context) throws IOException {
+        Args.notNull(host, "HTTP host");
+        Args.notNull(remoteAddress, "Remote address");
+        final Socket sock = socket != null ? socket : createSocket(context);
+        if (localAddress != null) {
+            sock.bind(localAddress);
+        }
+        try {
+            sock.connect(remoteAddress, connectTimeout);
+        } catch (final IOException ex) {
+            try {
+                sock.close();
+            } catch (final IOException ignore) {
+            }
+            throw ex;
+        }
+        // Setup SSL layering if necessary
+        if (sock instanceof SSLSocket) {
+            final SSLSocket sslsock = (SSLSocket) sock;
+            sslsock.startHandshake();
+            verifyHostname(sslsock, host.getHostName());
+            return sock;
+        } else {
+            return createLayeredSocket(sock, host.getHostName(), remoteAddress.getPort(), context);
+        }
+    }
+
+    public Socket createLayeredSocket(
+            final Socket socket,
+            final String target,
+            final int port,
+            final HttpContext context) throws IOException {
+        final SSLSocket sslsock = (SSLSocket) this.socketfactory.createSocket(
+                socket,
+                target,
+                port,
+                true);
+        if (supportedProtocols != null) {
+            sslsock.setEnabledProtocols(supportedProtocols);
+        }
+        if (supportedCipherSuites != null) {
+            sslsock.setEnabledCipherSuites(supportedCipherSuites);
+        }
+        prepareSocket(sslsock);
+        sslsock.startHandshake();
+        verifyHostname(sslsock, target);
+        return sslsock;
+    }
+
+    X509HostnameVerifier getHostnameVerifier() {
+        return this.hostnameVerifier;
+    }
+
+    private void verifyHostname(final SSLSocket sslsock, final String hostname) throws IOException {
+        try {
+            this.hostnameVerifier.verify(hostname, sslsock);
+            // verifyHostName() didn't blowup - good!
+        } catch (final IOException iox) {
+            // close the socket before re-throwing the exception
+            try { sslsock.close(); } catch (final Exception x) { /*ignore*/ }
+            throw iox;
+        }
+    }
+
+}
diff --git a/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/SSLContextBuilder.java b/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/SSLContextBuilder.java
new file mode 100644
index 000000000..89751a166
--- /dev/null
+++ b/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/SSLContextBuilder.java
@@ -0,0 +1,259 @@
+/*
+ * ====================================================================
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ * ====================================================================
+ *
+ * This software consists of voluntary contributions made by many
+ * individuals on behalf of the Apache Software Foundation.  For more
+ * information on the Apache Software Foundation, please see
+ * <http://www.apache.org/>.
+ *
+ */
+
+package ch.boye.httpclientandroidlib.conn.ssl;
+
+import java.net.Socket;
+import java.security.KeyManagementException;
+import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
+import java.security.Principal;
+import java.security.PrivateKey;
+import java.security.SecureRandom;
+import java.security.UnrecoverableKeyException;
+import java.security.cert.CertificateException;
+import java.security.cert.X509Certificate;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.Map;
+import java.util.Set;
+
+import javax.net.ssl.KeyManager;
+import javax.net.ssl.KeyManagerFactory;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.TrustManagerFactory;
+import javax.net.ssl.X509KeyManager;
+import javax.net.ssl.X509TrustManager;
+
+import ch.boye.httpclientandroidlib.annotation.NotThreadSafe;
+
+/**
+ * Builder for {@link SSLContext} instances.
+ *
+ * @since 4.3
+ */
+@NotThreadSafe
+public class SSLContextBuilder {
+
+    static final String TLS   = "TLS";
+    static final String SSL   = "SSL";
+
+    private String protocol;
+    private Set<KeyManager> keymanagers;
+    private Set<TrustManager> trustmanagers;
+    private SecureRandom secureRandom;
+
+    public SSLContextBuilder() {
+        super();
+        this.keymanagers = new HashSet<KeyManager>();
+        this.trustmanagers = new HashSet<TrustManager>();
+    }
+
+    public SSLContextBuilder useTLS() {
+        this.protocol = TLS;
+        return this;
+    }
+
+    public SSLContextBuilder useSSL() {
+        this.protocol = SSL;
+        return this;
+    }
+
+    public SSLContextBuilder useProtocol(final String protocol) {
+        this.protocol = protocol;
+        return this;
+    }
+
+    public SSLContextBuilder setSecureRandom(final SecureRandom secureRandom) {
+        this.secureRandom = secureRandom;
+        return this;
+    }
+
+    public SSLContextBuilder loadTrustMaterial(
+            final KeyStore truststore,
+            final TrustStrategy trustStrategy) throws NoSuchAlgorithmException, KeyStoreException {
+        final TrustManagerFactory tmfactory = TrustManagerFactory.getInstance(
+                TrustManagerFactory.getDefaultAlgorithm());
+        tmfactory.init(truststore);
+        final TrustManager[] tms = tmfactory.getTrustManagers();
+        if (tms != null) {
+            if (trustStrategy != null) {
+                for (int i = 0; i < tms.length; i++) {
+                    final TrustManager tm = tms[i];
+                    if (tm instanceof X509TrustManager) {
+                        tms[i] = new TrustManagerDelegate(
+                                (X509TrustManager) tm, trustStrategy);
+                    }
+                }
+            }
+            for (final TrustManager tm : tms) {
+                this.trustmanagers.add(tm);
+            }
+        }
+        return this;
+    }
+
+    public SSLContextBuilder loadTrustMaterial(
+            final KeyStore truststore) throws NoSuchAlgorithmException, KeyStoreException {
+        return loadTrustMaterial(truststore, null);
+    }
+
+    public SSLContextBuilder loadKeyMaterial(
+            final KeyStore keystore,
+            final char[] keyPassword)
+                throws NoSuchAlgorithmException, KeyStoreException, UnrecoverableKeyException {
+        loadKeyMaterial(keystore, keyPassword, null);
+        return this;
+    }
+
+    public SSLContextBuilder loadKeyMaterial(
+            final KeyStore keystore,
+            final char[] keyPassword,
+            final PrivateKeyStrategy aliasStrategy)
+            throws NoSuchAlgorithmException, KeyStoreException, UnrecoverableKeyException {
+        final KeyManagerFactory kmfactory = KeyManagerFactory.getInstance(
+                KeyManagerFactory.getDefaultAlgorithm());
+        kmfactory.init(keystore, keyPassword);
+        final KeyManager[] kms =  kmfactory.getKeyManagers();
+        if (kms != null) {
+            if (aliasStrategy != null) {
+                for (int i = 0; i < kms.length; i++) {
+                    final KeyManager km = kms[i];
+                    if (km instanceof X509KeyManager) {
+                        kms[i] = new KeyManagerDelegate(
+                                (X509KeyManager) km, aliasStrategy);
+                    }
+                }
+            }
+            for (final KeyManager km : kms) {
+                keymanagers.add(km);
+            }
+        }
+        return this;
+    }
+
+    public SSLContext build() throws NoSuchAlgorithmException, KeyManagementException {
+        final SSLContext sslcontext = SSLContext.getInstance(
+                this.protocol != null ? this.protocol : TLS);
+        sslcontext.init(
+                !keymanagers.isEmpty() ? keymanagers.toArray(new KeyManager[keymanagers.size()]) : null,
+                !trustmanagers.isEmpty() ? trustmanagers.toArray(new TrustManager[trustmanagers.size()]) : null,
+                secureRandom);
+        return sslcontext;
+    }
+
+    static class TrustManagerDelegate implements X509TrustManager {
+
+        private final X509TrustManager trustManager;
+        private final TrustStrategy trustStrategy;
+
+        TrustManagerDelegate(final X509TrustManager trustManager, final TrustStrategy trustStrategy) {
+            super();
+            this.trustManager = trustManager;
+            this.trustStrategy = trustStrategy;
+        }
+
+        public void checkClientTrusted(
+                final X509Certificate[] chain, final String authType) throws CertificateException {
+            this.trustManager.checkClientTrusted(chain, authType);
+        }
+
+        public void checkServerTrusted(
+                final X509Certificate[] chain, final String authType) throws CertificateException {
+            if (!this.trustStrategy.isTrusted(chain, authType)) {
+                this.trustManager.checkServerTrusted(chain, authType);
+            }
+        }
+
+        public X509Certificate[] getAcceptedIssuers() {
+            return this.trustManager.getAcceptedIssuers();
+        }
+
+    }
+
+    static class KeyManagerDelegate implements X509KeyManager {
+
+        private final X509KeyManager keyManager;
+        private final PrivateKeyStrategy aliasStrategy;
+
+        KeyManagerDelegate(final X509KeyManager keyManager, final PrivateKeyStrategy aliasStrategy) {
+            super();
+            this.keyManager = keyManager;
+            this.aliasStrategy = aliasStrategy;
+        }
+
+        public String[] getClientAliases(
+                final String keyType, final Principal[] issuers) {
+            return this.keyManager.getClientAliases(keyType, issuers);
+        }
+
+        public String chooseClientAlias(
+                final String[] keyTypes, final Principal[] issuers, final Socket socket) {
+            final Map<String, PrivateKeyDetails> validAliases = new HashMap<String, PrivateKeyDetails>();
+            for (final String keyType: keyTypes) {
+                final String[] aliases = this.keyManager.getClientAliases(keyType, issuers);
+                if (aliases != null) {
+                    for (final String alias: aliases) {
+                        validAliases.put(alias,
+                                new PrivateKeyDetails(keyType, this.keyManager.getCertificateChain(alias)));
+                    }
+                }
+            }
+            return this.aliasStrategy.chooseAlias(validAliases, socket);
+        }
+
+        public String[] getServerAliases(
+                final String keyType, final Principal[] issuers) {
+            return this.keyManager.getServerAliases(keyType, issuers);
+        }
+
+        public String chooseServerAlias(
+                final String keyType, final Principal[] issuers, final Socket socket) {
+            final Map<String, PrivateKeyDetails> validAliases = new HashMap<String, PrivateKeyDetails>();
+            final String[] aliases = this.keyManager.getServerAliases(keyType, issuers);
+            if (aliases != null) {
+                for (final String alias: aliases) {
+                    validAliases.put(alias,
+                            new PrivateKeyDetails(keyType, this.keyManager.getCertificateChain(alias)));
+                }
+            }
+            return this.aliasStrategy.chooseAlias(validAliases, socket);
+        }
+
+        public X509Certificate[] getCertificateChain(final String alias) {
+            return this.keyManager.getCertificateChain(alias);
+        }
+
+        public PrivateKey getPrivateKey(final String alias) {
+            return this.keyManager.getPrivateKey(alias);
+        }
+
+    }
+
+}
diff --git a/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/SSLContexts.java b/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/SSLContexts.java
new file mode 100644
index 000000000..a87a50168
--- /dev/null
+++ b/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/SSLContexts.java
@@ -0,0 +1,90 @@
+/*
+ * ====================================================================
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ * ====================================================================
+ *
+ * This software consists of voluntary contributions made by many
+ * individuals on behalf of the Apache Software Foundation.  For more
+ * information on the Apache Software Foundation, please see
+ * <http://www.apache.org/>.
+ *
+ */
+
+package ch.boye.httpclientandroidlib.conn.ssl;
+
+import java.security.KeyManagementException;
+import java.security.NoSuchAlgorithmException;
+
+import javax.net.ssl.SSLContext;
+
+import ch.boye.httpclientandroidlib.annotation.Immutable;
+
+/**
+ * {@link SSLContext} factory methods.
+ *
+ * @since 4.3
+ */
+@Immutable
+public class SSLContexts {
+
+    /**
+     * Creates default factory based on the standard JSSE trust material
+     * (<code>cacerts</code> file in the security properties directory). System properties
+     * are not taken into consideration.
+     *
+     * @return the default SSL socket factory
+     */
+    public static SSLContext createDefault() throws SSLInitializationException {
+        try {
+            final SSLContext sslcontext = SSLContext.getInstance(SSLContextBuilder.TLS);
+            sslcontext.init(null, null, null);
+            return sslcontext;
+        } catch (final NoSuchAlgorithmException ex) {
+            throw new SSLInitializationException(ex.getMessage(), ex);
+        } catch (final KeyManagementException ex) {
+            throw new SSLInitializationException(ex.getMessage(), ex);
+        }
+    }
+
+    /**
+     * Creates default SSL context based on system properties. This method obtains
+     * default SSL context by calling <code>SSLContext.getInstance("Default")</code>.
+     * Please note that <code>Default</code> algorithm is supported as of Java 6.
+     * This method will fall back onto {@link #createDefault()} when
+     * <code>Default</code> algorithm is not available.
+     *
+     * @return default system SSL context
+     */
+    public static SSLContext createSystemDefault() throws SSLInitializationException {
+        try {
+            return SSLContext.getInstance("Default");
+        } catch (final NoSuchAlgorithmException ex) {
+            return createDefault();
+        }
+    }
+
+    /**
+     * Creates custom SSL context.
+     *
+     * @return default system SSL context
+     */
+    public static SSLContextBuilder custom() {
+        return new SSLContextBuilder();
+    }
+
+}
diff --git a/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/SSLInitializationException.java b/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/SSLInitializationException.java
new file mode 100644
index 000000000..98cb5f9c3
--- /dev/null
+++ b/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/SSLInitializationException.java
@@ -0,0 +1,37 @@
+/*
+ * ====================================================================
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ * ====================================================================
+ *
+ * This software consists of voluntary contributions made by many
+ * individuals on behalf of the Apache Software Foundation.  For more
+ * information on the Apache Software Foundation, please see
+ * <http://www.apache.org/>.
+ *
+ */
+package ch.boye.httpclientandroidlib.conn.ssl;
+
+public class SSLInitializationException extends IllegalStateException {
+
+    private static final long serialVersionUID = -8243587425648536702L;
+
+    public SSLInitializationException(final String message, final Throwable cause) {
+        super(message, cause);
+    }
+
+}
diff --git a/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/SSLSocketFactory.java b/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/SSLSocketFactory.java
new file mode 100644
index 000000000..5c514d780
--- /dev/null
+++ b/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/SSLSocketFactory.java
@@ -0,0 +1,570 @@
+/*
+ * ====================================================================
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ * ====================================================================
+ *
+ * This software consists of voluntary contributions made by many
+ * individuals on behalf of the Apache Software Foundation.  For more
+ * information on the Apache Software Foundation, please see
+ * <http://www.apache.org/>.
+ *
+ */
+
+package ch.boye.httpclientandroidlib.conn.ssl;
+
+import java.io.IOException;
+import java.net.InetAddress;
+import java.net.InetSocketAddress;
+import java.net.Socket;
+import java.net.UnknownHostException;
+import java.security.KeyManagementException;
+import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
+import java.security.SecureRandom;
+import java.security.UnrecoverableKeyException;
+
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLSocket;
+
+import ch.boye.httpclientandroidlib.HttpHost;
+import ch.boye.httpclientandroidlib.annotation.ThreadSafe;
+import ch.boye.httpclientandroidlib.conn.ConnectTimeoutException;
+import ch.boye.httpclientandroidlib.conn.HttpInetSocketAddress;
+import ch.boye.httpclientandroidlib.conn.scheme.HostNameResolver;
+import ch.boye.httpclientandroidlib.conn.scheme.LayeredSchemeSocketFactory;
+import ch.boye.httpclientandroidlib.conn.scheme.LayeredSocketFactory;
+import ch.boye.httpclientandroidlib.conn.scheme.SchemeLayeredSocketFactory;
+import ch.boye.httpclientandroidlib.conn.socket.LayeredConnectionSocketFactory;
+import ch.boye.httpclientandroidlib.params.HttpConnectionParams;
+import ch.boye.httpclientandroidlib.params.HttpParams;
+import ch.boye.httpclientandroidlib.protocol.HttpContext;
+import ch.boye.httpclientandroidlib.util.Args;
+import ch.boye.httpclientandroidlib.util.Asserts;
+import ch.boye.httpclientandroidlib.util.TextUtils;
+
+/**
+ * Layered socket factory for TLS/SSL connections.
+ * <p>
+ * SSLSocketFactory can be used to validate the identity of the HTTPS server against a list of
+ * trusted certificates and to authenticate to the HTTPS server using a private key.
+ * <p>
+ * SSLSocketFactory will enable server authentication when supplied with
+ * a {@link KeyStore trust-store} file containing one or several trusted certificates. The client
+ * secure socket will reject the connection during the SSL session handshake if the target HTTPS
+ * server attempts to authenticate itself with a non-trusted certificate.
+ * <p>
+ * Use JDK keytool utility to import a trusted certificate and generate a trust-store file:
+ *    <pre>
+ *     keytool -import -alias "my server cert" -file server.crt -keystore my.truststore
+ *    </pre>
+ * <p>
+ * In special cases the standard trust verification process can be bypassed by using a custom
+ * {@link TrustStrategy}. This interface is primarily intended for allowing self-signed
+ * certificates to be accepted as trusted without having to add them to the trust-store file.
+ * <p>
+ * SSLSocketFactory will enable client authentication when supplied with
+ * a {@link KeyStore key-store} file containing a private key/public certificate
+ * pair. The client secure socket will use the private key to authenticate
+ * itself to the target HTTPS server during the SSL session handshake if
+ * requested to do so by the server.
+ * The target HTTPS server will in its turn verify the certificate presented
+ * by the client in order to establish client's authenticity.
+ * <p>
+ * Use the following sequence of actions to generate a key-store file
+ * </p>
+ *   <ul>
+ *     <li>
+ *      <p>
+ *      Use JDK keytool utility to generate a new key
+ *      <pre>keytool -genkey -v -alias "my client key" -validity 365 -keystore my.keystore</pre>
+ *      For simplicity use the same password for the key as that of the key-store
+ *      </p>
+ *     </li>
+ *     <li>
+ *      <p>
+ *      Issue a certificate signing request (CSR)
+ *      <pre>keytool -certreq -alias "my client key" -file mycertreq.csr -keystore my.keystore</pre>
+ *     </p>
+ *     </li>
+ *     <li>
+ *      <p>
+ *      Send the certificate request to the trusted Certificate Authority for signature.
+ *      One may choose to act as her own CA and sign the certificate request using a PKI
+ *      tool, such as OpenSSL.
+ *      </p>
+ *     </li>
+ *     <li>
+ *      <p>
+ *       Import the trusted CA root certificate
+ *       <pre>keytool -import -alias "my trusted ca" -file caroot.crt -keystore my.keystore</pre>
+ *      </p>
+ *     </li>
+ *     <li>
+ *      <p>
+ *       Import the PKCS#7 file containg the complete certificate chain
+ *       <pre>keytool -import -alias "my client key" -file mycert.p7 -keystore my.keystore</pre>
+ *      </p>
+ *     </li>
+ *     <li>
+ *      <p>
+ *       Verify the content the resultant keystore file
+ *       <pre>keytool -list -v -keystore my.keystore</pre>
+ *      </p>
+ *     </li>
+ *   </ul>
+ *
+ * @since 4.0
+ *
+ * @deprecated (4.3) use {@link SSLConnectionSocketFactory}.
+ */
+@ThreadSafe
+@Deprecated
+public class SSLSocketFactory implements LayeredConnectionSocketFactory, SchemeLayeredSocketFactory,
+                                         LayeredSchemeSocketFactory, LayeredSocketFactory {
+
+    public static final String TLS   = "TLS";
+    public static final String SSL   = "SSL";
+    public static final String SSLV2 = "SSLv2";
+
+    public static final X509HostnameVerifier ALLOW_ALL_HOSTNAME_VERIFIER
+        = new AllowAllHostnameVerifier();
+
+    public static final X509HostnameVerifier BROWSER_COMPATIBLE_HOSTNAME_VERIFIER
+        = new BrowserCompatHostnameVerifier();
+
+    public static final X509HostnameVerifier STRICT_HOSTNAME_VERIFIER
+        = new StrictHostnameVerifier();
+
+    /**
+     * Obtains default SSL socket factory with an SSL context based on the standard JSSE
+     * trust material (<code>cacerts</code> file in the security properties directory).
+     * System properties are not taken into consideration.
+     *
+     * @return default SSL socket factory
+     */
+    public static SSLSocketFactory getSocketFactory() throws SSLInitializationException {
+        return new SSLSocketFactory(
+            SSLContexts.createDefault(),
+            BROWSER_COMPATIBLE_HOSTNAME_VERIFIER);
+    }
+
+    private static String[] split(final String s) {
+        if (TextUtils.isBlank(s)) {
+            return null;
+        }
+        return s.split(" *, *");
+    }
+
+    /**
+     * Obtains default SSL socket factory with an SSL context based on system properties
+     * as described in
+     * <a href="http://docs.oracle.com/javase/1.5.0/docs/guide/security/jsse/JSSERefGuide.html">
+     * "JavaTM Secure Socket Extension (JSSE) Reference Guide for the JavaTM 2 Platform
+     * Standard Edition 5</a>
+     *
+     * @return default system SSL socket factory
+     */
+    public static SSLSocketFactory getSystemSocketFactory() throws SSLInitializationException {
+        return new SSLSocketFactory(
+            (javax.net.ssl.SSLSocketFactory) javax.net.ssl.SSLSocketFactory.getDefault(),
+            split(System.getProperty("https.protocols")),
+            split(System.getProperty("https.cipherSuites")),
+            BROWSER_COMPATIBLE_HOSTNAME_VERIFIER);
+    }
+
+    private final javax.net.ssl.SSLSocketFactory socketfactory;
+    private final HostNameResolver nameResolver;
+    // TODO: make final
+    private volatile X509HostnameVerifier hostnameVerifier;
+    private final String[] supportedProtocols;
+    private final String[] supportedCipherSuites;
+
+    public SSLSocketFactory(
+            final String algorithm,
+            final KeyStore keystore,
+            final String keyPassword,
+            final KeyStore truststore,
+            final SecureRandom random,
+            final HostNameResolver nameResolver)
+                throws NoSuchAlgorithmException, KeyManagementException, KeyStoreException, UnrecoverableKeyException {
+        this(SSLContexts.custom()
+                .useProtocol(algorithm)
+                .setSecureRandom(random)
+                .loadKeyMaterial(keystore, keyPassword != null ? keyPassword.toCharArray() : null)
+                .loadTrustMaterial(truststore)
+                .build(),
+                nameResolver);
+    }
+
+    /**
+     * @since 4.1
+     */
+    public SSLSocketFactory(
+            final String algorithm,
+            final KeyStore keystore,
+            final String keyPassword,
+            final KeyStore truststore,
+            final SecureRandom random,
+            final TrustStrategy trustStrategy,
+            final X509HostnameVerifier hostnameVerifier)
+                throws NoSuchAlgorithmException, KeyManagementException, KeyStoreException, UnrecoverableKeyException {
+        this(SSLContexts.custom()
+                .useProtocol(algorithm)
+                .setSecureRandom(random)
+                .loadKeyMaterial(keystore, keyPassword != null ? keyPassword.toCharArray() : null)
+                .loadTrustMaterial(truststore, trustStrategy)
+                .build(),
+                hostnameVerifier);
+    }
+
+    /**
+     * @since 4.1
+     */
+    public SSLSocketFactory(
+            final String algorithm,
+            final KeyStore keystore,
+            final String keyPassword,
+            final KeyStore truststore,
+            final SecureRandom random,
+            final X509HostnameVerifier hostnameVerifier)
+                throws NoSuchAlgorithmException, KeyManagementException, KeyStoreException, UnrecoverableKeyException {
+        this(SSLContexts.custom()
+                .useProtocol(algorithm)
+                .setSecureRandom(random)
+                .loadKeyMaterial(keystore, keyPassword != null ? keyPassword.toCharArray() : null)
+                .loadTrustMaterial(truststore)
+                .build(),
+                hostnameVerifier);
+    }
+
+    public SSLSocketFactory(
+            final KeyStore keystore,
+            final String keystorePassword,
+            final KeyStore truststore)
+                throws NoSuchAlgorithmException, KeyManagementException, KeyStoreException, UnrecoverableKeyException {
+        this(SSLContexts.custom()
+                .loadKeyMaterial(keystore, keystorePassword != null ? keystorePassword.toCharArray() : null)
+                .loadTrustMaterial(truststore)
+                .build(),
+                BROWSER_COMPATIBLE_HOSTNAME_VERIFIER);
+    }
+
+    public SSLSocketFactory(
+            final KeyStore keystore,
+            final String keystorePassword)
+                throws NoSuchAlgorithmException, KeyManagementException, KeyStoreException, UnrecoverableKeyException{
+        this(SSLContexts.custom()
+                .loadKeyMaterial(keystore, keystorePassword != null ? keystorePassword.toCharArray() : null)
+                .build(),
+                BROWSER_COMPATIBLE_HOSTNAME_VERIFIER);
+    }
+
+    public SSLSocketFactory(
+            final KeyStore truststore)
+                throws NoSuchAlgorithmException, KeyManagementException, KeyStoreException, UnrecoverableKeyException {
+        this(SSLContexts.custom()
+                .loadTrustMaterial(truststore)
+                .build(),
+                BROWSER_COMPATIBLE_HOSTNAME_VERIFIER);
+    }
+
+    /**
+     * @since 4.1
+     */
+    public SSLSocketFactory(
+            final TrustStrategy trustStrategy,
+            final X509HostnameVerifier hostnameVerifier)
+                throws NoSuchAlgorithmException, KeyManagementException, KeyStoreException, UnrecoverableKeyException {
+        this(SSLContexts.custom()
+                .loadTrustMaterial(null, trustStrategy)
+                .build(),
+                hostnameVerifier);
+    }
+
+    /**
+     * @since 4.1
+     */
+    public SSLSocketFactory(
+            final TrustStrategy trustStrategy)
+                throws NoSuchAlgorithmException, KeyManagementException, KeyStoreException, UnrecoverableKeyException {
+        this(SSLContexts.custom()
+                .loadTrustMaterial(null, trustStrategy)
+                .build(),
+                BROWSER_COMPATIBLE_HOSTNAME_VERIFIER);
+    }
+
+    public SSLSocketFactory(final SSLContext sslContext) {
+        this(sslContext, BROWSER_COMPATIBLE_HOSTNAME_VERIFIER);
+    }
+
+    public SSLSocketFactory(
+            final SSLContext sslContext, final HostNameResolver nameResolver) {
+        super();
+        this.socketfactory = sslContext.getSocketFactory();
+        this.hostnameVerifier = BROWSER_COMPATIBLE_HOSTNAME_VERIFIER;
+        this.nameResolver = nameResolver;
+        this.supportedProtocols = null;
+        this.supportedCipherSuites = null;
+    }
+
+    /**
+     * @since 4.1
+     */
+    public SSLSocketFactory(
+            final SSLContext sslContext, final X509HostnameVerifier hostnameVerifier) {
+        this(Args.notNull(sslContext, "SSL context").getSocketFactory(),
+                null, null, hostnameVerifier);
+    }
+
+    /**
+     * @since 4.3
+     */
+    public SSLSocketFactory(
+            final SSLContext sslContext,
+            final String[] supportedProtocols,
+            final String[] supportedCipherSuites,
+            final X509HostnameVerifier hostnameVerifier) {
+        this(Args.notNull(sslContext, "SSL context").getSocketFactory(),
+                supportedProtocols, supportedCipherSuites, hostnameVerifier);
+    }
+
+    /**
+     * @since 4.2
+     */
+    public SSLSocketFactory(
+            final javax.net.ssl.SSLSocketFactory socketfactory,
+            final X509HostnameVerifier hostnameVerifier) {
+        this(socketfactory, null, null, hostnameVerifier);
+    }
+
+    /**
+     * @since 4.3
+     */
+    public SSLSocketFactory(
+            final javax.net.ssl.SSLSocketFactory socketfactory,
+            final String[] supportedProtocols,
+            final String[] supportedCipherSuites,
+            final X509HostnameVerifier hostnameVerifier) {
+        this.socketfactory = Args.notNull(socketfactory, "SSL socket factory");
+        this.supportedProtocols = supportedProtocols;
+        this.supportedCipherSuites = supportedCipherSuites;
+        this.hostnameVerifier = hostnameVerifier != null ? hostnameVerifier : BROWSER_COMPATIBLE_HOSTNAME_VERIFIER;
+        this.nameResolver = null;
+    }
+
+    /**
+     * @param params Optional parameters. Parameters passed to this method will have no effect.
+     *               This method will create a unconnected instance of {@link Socket} class.
+     * @since 4.1
+     */
+    public Socket createSocket(final HttpParams params) throws IOException {
+        return createSocket((HttpContext) null);
+    }
+
+    public Socket createSocket() throws IOException {
+        return createSocket((HttpContext) null);
+    }
+
+    /**
+     * @since 4.1
+     */
+    public Socket connectSocket(
+            final Socket socket,
+            final InetSocketAddress remoteAddress,
+            final InetSocketAddress localAddress,
+            final HttpParams params) throws IOException, UnknownHostException, ConnectTimeoutException {
+        Args.notNull(remoteAddress, "Remote address");
+        Args.notNull(params, "HTTP parameters");
+        final HttpHost host;
+        if (remoteAddress instanceof HttpInetSocketAddress) {
+            host = ((HttpInetSocketAddress) remoteAddress).getHttpHost();
+        } else {
+            host = new HttpHost(remoteAddress.getHostName(), remoteAddress.getPort(), "https");
+        }
+        final int socketTimeout = HttpConnectionParams.getSoTimeout(params);
+        final int connectTimeout = HttpConnectionParams.getConnectionTimeout(params);
+        socket.setSoTimeout(socketTimeout);
+        return connectSocket(connectTimeout, socket, host, remoteAddress, localAddress, null);
+    }
+
+    /**
+     * Checks whether a socket connection is secure.
+     * This factory creates TLS/SSL socket connections
+     * which, by default, are considered secure.
+     * <br/>
+     * Derived classes may override this method to perform
+     * runtime checks, for example based on the cypher suite.
+     *
+     * @param sock      the connected socket
+     *
+     * @return  <code>true</code>
+     *
+     * @throws IllegalArgumentException if the argument is invalid
+     */
+    public boolean isSecure(final Socket sock) throws IllegalArgumentException {
+        Args.notNull(sock, "Socket");
+        Asserts.check(sock instanceof SSLSocket, "Socket not created by this factory");
+        Asserts.check(!sock.isClosed(), "Socket is closed");
+        return true;
+    }
+
+    /**
+     * @since 4.2
+     */
+    public Socket createLayeredSocket(
+        final Socket socket,
+        final String host,
+        final int port,
+        final HttpParams params) throws IOException, UnknownHostException {
+        return createLayeredSocket(socket, host, port, (HttpContext) null);
+    }
+
+    public Socket createLayeredSocket(
+        final Socket socket,
+        final String host,
+        final int port,
+        final boolean autoClose) throws IOException, UnknownHostException {
+        return createLayeredSocket(socket, host, port, (HttpContext) null);
+    }
+
+    public void setHostnameVerifier(final X509HostnameVerifier hostnameVerifier) {
+        Args.notNull(hostnameVerifier, "Hostname verifier");
+        this.hostnameVerifier = hostnameVerifier;
+    }
+
+    public X509HostnameVerifier getHostnameVerifier() {
+        return this.hostnameVerifier;
+    }
+
+    public Socket connectSocket(
+            final Socket socket,
+            final String host, final int port,
+            final InetAddress local, final int localPort,
+            final HttpParams params) throws IOException, UnknownHostException, ConnectTimeoutException {
+        final InetAddress remote;
+        if (this.nameResolver != null) {
+            remote = this.nameResolver.resolve(host);
+        } else {
+            remote = InetAddress.getByName(host);
+        }
+        InetSocketAddress localAddress = null;
+        if (local != null || localPort > 0) {
+            localAddress = new InetSocketAddress(local, localPort > 0 ? localPort : 0);
+        }
+        final InetSocketAddress remoteAddress = new HttpInetSocketAddress(
+                new HttpHost(host, port), remote, port);
+        return connectSocket(socket, remoteAddress, localAddress, params);
+    }
+
+    public Socket createSocket(
+            final Socket socket,
+            final String host, final int port,
+            final boolean autoClose) throws IOException, UnknownHostException {
+        return createLayeredSocket(socket, host, port, autoClose);
+    }
+
+    /**
+     * Performs any custom initialization for a newly created SSLSocket
+     * (before the SSL handshake happens).
+     *
+     * The default implementation is a no-op, but could be overridden to, e.g.,
+     * call {@link SSLSocket#setEnabledCipherSuites(java.lang.String[])}.
+     *
+     * @since 4.2
+     */
+    protected void prepareSocket(final SSLSocket socket) throws IOException {
+    }
+
+    private void internalPrepareSocket(final SSLSocket socket) throws IOException {
+        if (supportedProtocols != null) {
+            socket.setEnabledProtocols(supportedProtocols);
+        }
+        if (supportedCipherSuites != null) {
+            socket.setEnabledCipherSuites(supportedCipherSuites);
+        }
+        prepareSocket(socket);
+    }
+
+    public Socket createSocket(final HttpContext context) throws IOException {
+        final SSLSocket sock = (SSLSocket) this.socketfactory.createSocket();
+        internalPrepareSocket(sock);
+        return sock;
+    }
+
+    public Socket connectSocket(
+            final int connectTimeout,
+            final Socket socket,
+            final HttpHost host,
+            final InetSocketAddress remoteAddress,
+            final InetSocketAddress localAddress,
+            final HttpContext context) throws IOException {
+        Args.notNull(host, "HTTP host");
+        Args.notNull(remoteAddress, "Remote address");
+        final Socket sock = socket != null ? socket : createSocket(context);
+        if (localAddress != null) {
+            sock.bind(localAddress);
+        }
+        try {
+            sock.connect(remoteAddress, connectTimeout);
+        } catch (final IOException ex) {
+            try {
+                sock.close();
+            } catch (final IOException ignore) {
+            }
+            throw ex;
+        }
+        // Setup SSL layering if necessary
+        if (sock instanceof SSLSocket) {
+            final SSLSocket sslsock = (SSLSocket) sock;
+            sslsock.startHandshake();
+            verifyHostname(sslsock, host.getHostName());
+            return sock;
+        } else {
+            return createLayeredSocket(sock, host.getHostName(), remoteAddress.getPort(), context);
+        }
+    }
+
+    public Socket createLayeredSocket(
+            final Socket socket,
+            final String target,
+            final int port,
+            final HttpContext context) throws IOException {
+        final SSLSocket sslsock = (SSLSocket) this.socketfactory.createSocket(
+                socket,
+                target,
+                port,
+                true);
+        internalPrepareSocket(sslsock);
+        sslsock.startHandshake();
+        verifyHostname(sslsock, target);
+        return sslsock;
+    }
+
+    private void verifyHostname(final SSLSocket sslsock, final String hostname) throws IOException {
+        try {
+            this.hostnameVerifier.verify(hostname, sslsock);
+            // verifyHostName() didn't blowup - good!
+        } catch (final IOException iox) {
+            // close the socket before re-throwing the exception
+            try { sslsock.close(); } catch (final Exception x) { /*ignore*/ }
+            throw iox;
+        }
+    }
+
+}
diff --git a/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/StrictHostnameVerifier.java b/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/StrictHostnameVerifier.java
new file mode 100644
index 000000000..a6328a10c
--- /dev/null
+++ b/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/StrictHostnameVerifier.java
@@ -0,0 +1,69 @@
+/*
+ * ====================================================================
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ * ====================================================================
+ *
+ * This software consists of voluntary contributions made by many
+ * individuals on behalf of the Apache Software Foundation.  For more
+ * information on the Apache Software Foundation, please see
+ * <http://www.apache.org/>.
+ *
+ */
+
+package ch.boye.httpclientandroidlib.conn.ssl;
+
+import javax.net.ssl.SSLException;
+
+import ch.boye.httpclientandroidlib.annotation.Immutable;
+
+/**
+ * The Strict HostnameVerifier works the same way as Sun Java 1.4, Sun
+ * Java 5, Sun Java 6-rc.  It's also pretty close to IE6.  This
+ * implementation appears to be compliant with RFC 2818 for dealing with
+ * wildcards.
+ * <p/>
+ * The hostname must match either the first CN, or any of the subject-alts.
+ * A wildcard can occur in the CN, and in any of the subject-alts.  The
+ * one divergence from IE6 is how we only check the first CN.  IE6 allows
+ * a match against any of the CNs present.  We decided to follow in
+ * Sun Java 1.4's footsteps and only check the first CN.  (If you need
+ * to check all the CN's, feel free to write your own implementation!).
+ * <p/>
+ * A wildcard such as "*.foo.com" matches only subdomains in the same
+ * level, for example "a.foo.com".  It does not match deeper subdomains
+ * such as "a.b.foo.com".
+ *
+ *
+ * @since 4.0
+ */
+@Immutable
+public class StrictHostnameVerifier extends AbstractVerifier {
+
+    public final void verify(
+            final String host,
+            final String[] cns,
+            final String[] subjectAlts) throws SSLException {
+        verify(host, cns, subjectAlts, true);
+    }
+
+    @Override
+    public final String toString() {
+        return "STRICT";
+    }
+
+}
diff --git a/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/TokenParser.java b/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/TokenParser.java
new file mode 100644
index 000000000..25bdcc5e6
--- /dev/null
+++ b/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/TokenParser.java
@@ -0,0 +1,266 @@
+/*
+ * ====================================================================
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ * ====================================================================
+ *
+ * This software consists of voluntary contributions made by many
+ * individuals on behalf of the Apache Software Foundation.  For more
+ * information on the Apache Software Foundation, please see
+ * <http://www.apache.org/>.
+ *
+ */
+
+package ch.boye.httpclientandroidlib.conn.ssl;
+
+import java.util.BitSet;
+
+import ch.boye.httpclientandroidlib.message.ParserCursor;
+import ch.boye.httpclientandroidlib.util.CharArrayBuffer;
+
+/**
+ * Low level parser for header field elements. The parsing routines of this class are designed
+ * to produce near zero intermediate garbage and make no intermediate copies of input data.
+ * <p>
+ * This class is immutable and thread safe.
+ *
+ * Temporary package-private copy of ch.boye.httpclientandroidlib.message.TokenParser
+ */
+class TokenParser {
+
+    public static BitSet INIT_BITSET(final int ... b) {
+        final BitSet bitset = new BitSet();
+        for (final int aB : b) {
+            bitset.set(aB);
+        }
+        return bitset;
+    }
+
+    /** US-ASCII CR, carriage return (13) */
+    public static final char CR = '\r';
+
+    /** US-ASCII LF, line feed (10) */
+    public static final char LF = '\n';
+
+    /** US-ASCII SP, space (32) */
+    public static final char SP = ' ';
+
+    /** US-ASCII HT, horizontal-tab (9) */
+    public static final char HT = '\t';
+
+    /** Double quote */
+    public static final char DQUOTE = '\"';
+
+    /** Backward slash / escape character */
+    public static final char ESCAPE = '\\';
+
+    public static boolean isWhitespace(final char ch) {
+        return ch == SP || ch == HT || ch == CR || ch == LF;
+    }
+
+    public static final TokenParser INSTANCE = new TokenParser();
+
+    /**
+     * Extracts from the sequence of chars a token terminated with any of the given delimiters
+     * discarding semantically insignificant whitespace characters.
+     *
+     * @param buf buffer with the sequence of chars to be parsed
+     * @param cursor defines the bounds and current position of the buffer
+     * @param delimiters set of delimiting characters. Can be <code>null</code> if the token
+     *  is not delimited by any character.
+     */
+    public String parseToken(final CharArrayBuffer buf, final ParserCursor cursor, final BitSet delimiters) {
+        final StringBuilder dst = new StringBuilder();
+        boolean whitespace = false;
+        while (!cursor.atEnd()) {
+            final char current = buf.charAt(cursor.getPos());
+            if (delimiters != null && delimiters.get(current)) {
+                break;
+            } else if (isWhitespace(current)) {
+                skipWhiteSpace(buf, cursor);
+                whitespace = true;
+            } else {
+                if (whitespace && dst.length() > 0) {
+                    dst.append(' ');
+                }
+                copyContent(buf, cursor, delimiters, dst);
+                whitespace = false;
+            }
+        }
+        return dst.toString();
+    }
+
+    /**
+     * Extracts from the sequence of chars a value which can be enclosed in quote marks and
+     * terminated with any of the given delimiters discarding semantically insignificant
+     * whitespace characters.
+     *
+     * @param buf buffer with the sequence of chars to be parsed
+     * @param cursor defines the bounds and current position of the buffer
+     * @param delimiters set of delimiting characters. Can be <code>null</code> if the value
+     *  is not delimited by any character.
+     */
+    public String parseValue(final CharArrayBuffer buf, final ParserCursor cursor, final BitSet delimiters) {
+        final StringBuilder dst = new StringBuilder();
+        boolean whitespace = false;
+        while (!cursor.atEnd()) {
+            final char current = buf.charAt(cursor.getPos());
+            if (delimiters != null && delimiters.get(current)) {
+                break;
+            } else if (isWhitespace(current)) {
+                skipWhiteSpace(buf, cursor);
+                whitespace = true;
+            } else if (current == DQUOTE) {
+                if (whitespace && dst.length() > 0) {
+                    dst.append(' ');
+                }
+                copyQuotedContent(buf, cursor, dst);
+                whitespace = false;
+            } else {
+                if (whitespace && dst.length() > 0) {
+                    dst.append(' ');
+                }
+                copyUnquotedContent(buf, cursor, delimiters, dst);
+                whitespace = false;
+            }
+        }
+        return dst.toString();
+    }
+
+    /**
+     * Skips semantically insignificant whitespace characters and moves the cursor to the closest
+     * non-whitespace character.
+     *
+     * @param buf buffer with the sequence of chars to be parsed
+     * @param cursor defines the bounds and current position of the buffer
+     */
+    public void skipWhiteSpace(final CharArrayBuffer buf, final ParserCursor cursor) {
+        int pos = cursor.getPos();
+        final int indexFrom = cursor.getPos();
+        final int indexTo = cursor.getUpperBound();
+        for (int i = indexFrom; i < indexTo; i++) {
+            final char current = buf.charAt(i);
+            if (!isWhitespace(current)) {
+                break;
+            } else {
+                pos++;
+            }
+        }
+        cursor.updatePos(pos);
+    }
+
+    /**
+     * Transfers content into the destination buffer until a whitespace character or any of
+     * the given delimiters is encountered.
+     *
+     * @param buf buffer with the sequence of chars to be parsed
+     * @param cursor defines the bounds and current position of the buffer
+     * @param delimiters set of delimiting characters. Can be <code>null</code> if the value
+     *  is delimited by a whitespace only.
+     * @param dst destination buffer
+     */
+    public void copyContent(final CharArrayBuffer buf, final ParserCursor cursor, final BitSet delimiters,
+            final StringBuilder dst) {
+        int pos = cursor.getPos();
+        final int indexFrom = cursor.getPos();
+        final int indexTo = cursor.getUpperBound();
+        for (int i = indexFrom; i < indexTo; i++) {
+            final char current = buf.charAt(i);
+            if ((delimiters != null && delimiters.get(current)) || isWhitespace(current)) {
+                break;
+            } else {
+                pos++;
+                dst.append(current);
+            }
+        }
+        cursor.updatePos(pos);
+    }
+
+    /**
+     * Transfers content into the destination buffer until a whitespace character,  a quote,
+     * or any of the given delimiters is encountered.
+     *
+     * @param buf buffer with the sequence of chars to be parsed
+     * @param cursor defines the bounds and current position of the buffer
+     * @param delimiters set of delimiting characters. Can be <code>null</code> if the value
+     *  is delimited by a whitespace or a quote only.
+     * @param dst destination buffer
+     */
+    public void copyUnquotedContent(final CharArrayBuffer buf, final ParserCursor cursor,
+            final BitSet delimiters, final StringBuilder dst) {
+        int pos = cursor.getPos();
+        final int indexFrom = cursor.getPos();
+        final int indexTo = cursor.getUpperBound();
+        for (int i = indexFrom; i < indexTo; i++) {
+            final char current = buf.charAt(i);
+            if ((delimiters != null && delimiters.get(current))
+                    || isWhitespace(current) || current == DQUOTE) {
+                break;
+            } else {
+                pos++;
+                dst.append(current);
+            }
+        }
+        cursor.updatePos(pos);
+    }
+
+    /**
+     * Transfers content enclosed with quote marks into the destination buffer.
+     *
+     * @param buf buffer with the sequence of chars to be parsed
+     * @param cursor defines the bounds and current position of the buffer
+     * @param dst destination buffer
+     */
+    public void copyQuotedContent(final CharArrayBuffer buf, final ParserCursor cursor,
+            final StringBuilder dst) {
+        if (cursor.atEnd()) {
+            return;
+        }
+        int pos = cursor.getPos();
+        int indexFrom = cursor.getPos();
+        final int indexTo = cursor.getUpperBound();
+        char current = buf.charAt(pos);
+        if (current != DQUOTE) {
+            return;
+        }
+        pos++;
+        indexFrom++;
+        boolean escaped = false;
+        for (int i = indexFrom; i < indexTo; i++, pos++) {
+            current = buf.charAt(i);
+            if (escaped) {
+                if (current != DQUOTE && current != ESCAPE) {
+                    dst.append(ESCAPE);
+                }
+                dst.append(current);
+                escaped = false;
+            } else {
+                if (current == DQUOTE) {
+                    pos++;
+                    break;
+                }
+                if (current == ESCAPE) {
+                    escaped = true;
+                } else if (current != CR && current != LF) {
+                    dst.append(current);
+                }
+            }
+        }
+        cursor.updatePos(pos);
+    }
+
+}
diff --git a/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/TrustSelfSignedStrategy.java b/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/TrustSelfSignedStrategy.java
new file mode 100644
index 000000000..a3c23690b
--- /dev/null
+++ b/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/TrustSelfSignedStrategy.java
@@ -0,0 +1,45 @@
+/*
+ * ====================================================================
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ * ====================================================================
+ *
+ * This software consists of voluntary contributions made by many
+ * individuals on behalf of the Apache Software Foundation.  For more
+ * information on the Apache Software Foundation, please see
+ * <http://www.apache.org/>.
+ *
+ */
+package ch.boye.httpclientandroidlib.conn.ssl;
+
+import java.security.cert.CertificateException;
+import java.security.cert.X509Certificate;
+
+/**
+ * A trust strategy that accepts self-signed certificates as trusted. Verification of all other
+ * certificates is done by the trust manager configured in the SSL context.
+ *
+ * @since 4.1
+ */
+public class TrustSelfSignedStrategy implements TrustStrategy {
+
+    public boolean isTrusted(
+            final X509Certificate[] chain, final String authType) throws CertificateException {
+        return chain.length == 1;
+    }
+
+}
diff --git a/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/TrustStrategy.java b/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/TrustStrategy.java
new file mode 100644
index 000000000..7f4914503
--- /dev/null
+++ b/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/TrustStrategy.java
@@ -0,0 +1,57 @@
+/*
+ * ====================================================================
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ * ====================================================================
+ *
+ * This software consists of voluntary contributions made by many
+ * individuals on behalf of the Apache Software Foundation.  For more
+ * information on the Apache Software Foundation, please see
+ * <http://www.apache.org/>.
+ *
+ */
+package ch.boye.httpclientandroidlib.conn.ssl;
+
+import java.security.cert.CertificateException;
+import java.security.cert.X509Certificate;
+
+/**
+ * A strategy to establish trustworthiness of certificates without consulting the trust manager
+ * configured in the actual SSL context. This interface can be used to override the standard
+ * JSSE certificate verification process.
+ *
+ * @since 4.1
+ */
+public interface TrustStrategy {
+
+    /**
+     * Determines whether the certificate chain can be trusted without consulting the trust manager
+     * configured in the actual SSL context. This method can be used to override the standard JSSE
+     * certificate verification process.
+     * <p>
+     * Please note that, if this method returns <code>false</code>, the trust manager configured
+     * in the actual SSL context can still clear the certificate as trusted.
+     *
+     * @param chain the peer certificate chain
+     * @param authType the authentication type based on the client certificate
+     * @return <code>true</code> if the certificate can be trusted without verification by
+     *   the trust manager, <code>false</code> otherwise.
+     * @throws CertificateException thrown if the certificate is not trusted or invalid.
+     */
+    boolean isTrusted(X509Certificate[] chain, String authType) throws CertificateException;
+
+}
diff --git a/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/X509HostnameVerifier.java b/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/X509HostnameVerifier.java
new file mode 100644
index 000000000..cd57c623e
--- /dev/null
+++ b/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/X509HostnameVerifier.java
@@ -0,0 +1,85 @@
+/*
+ * ====================================================================
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ * ====================================================================
+ *
+ * This software consists of voluntary contributions made by many
+ * individuals on behalf of the Apache Software Foundation.  For more
+ * information on the Apache Software Foundation, please see
+ * <http://www.apache.org/>.
+ *
+ */
+
+package ch.boye.httpclientandroidlib.conn.ssl;
+
+import java.io.IOException;
+import java.security.cert.X509Certificate;
+
+import javax.net.ssl.HostnameVerifier;
+import javax.net.ssl.SSLException;
+import javax.net.ssl.SSLSocket;
+
+/**
+ * Interface for checking if a hostname matches the names stored inside the
+ * server's X.509 certificate.  This interface extends
+ * {@link javax.net.ssl.HostnameVerifier}, but it is recommended to use
+ * methods added by X509HostnameVerifier.
+ *
+ * @since 4.0
+ */
+public interface X509HostnameVerifier extends HostnameVerifier {
+
+    /**
+     * Verifies that the host name is an acceptable match with the server's
+     * authentication scheme based on the given {@link SSLSocket}.
+     *
+     * @param host the host.
+     * @param ssl the SSL socket.
+     * @throws IOException if an I/O error occurs or the verification process
+     *   fails.
+     */
+    void verify(String host, SSLSocket ssl) throws IOException;
+
+    /**
+     * Verifies that the host name is an acceptable match with the server's
+     * authentication scheme based on the given {@link X509Certificate}.
+     *
+     * @param host the host.
+     * @param cert the certificate.
+     * @throws SSLException if the verification process fails.
+     */
+    void verify(String host, X509Certificate cert) throws SSLException;
+
+    /**
+     * Checks to see if the supplied hostname matches any of the supplied CNs
+     * or "DNS" Subject-Alts.  Most implementations only look at the first CN,
+     * and ignore any additional CNs.  Most implementations do look at all of
+     * the "DNS" Subject-Alts. The CNs or Subject-Alts may contain wildcards
+     * according to RFC 2818.
+     *
+     * @param cns         CN fields, in order, as extracted from the X.509
+     *                    certificate.
+     * @param subjectAlts Subject-Alt fields of type 2 ("DNS"), as extracted
+     *                    from the X.509 certificate.
+     * @param host        The hostname to verify.
+     * @throws SSLException if the verification process fails.
+     */
+    void verify(String host, String[] cns, String[] subjectAlts)
+          throws SSLException;
+
+}
diff --git a/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/package-info.java b/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/package-info.java
new file mode 100644
index 000000000..c05bf5be0
--- /dev/null
+++ b/mobile/android/thirdparty/ch/boye/httpclientandroidlib/conn/ssl/package-info.java
@@ -0,0 +1,31 @@
+/*
+ * ====================================================================
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ * ====================================================================
+ *
+ * This software consists of voluntary contributions made by many
+ * individuals on behalf of the Apache Software Foundation.  For more
+ * information on the Apache Software Foundation, please see
+ * <http://www.apache.org/>.
+ *
+ */
+
+/**
+ * Client TLS/SSL support.
+ */
+package ch.boye.httpclientandroidlib.conn.ssl;