This is a security issue and should be fixed. Both C2dmNotificationProvider.java and GcmNotificationProvider.java make use of noop TrustManager. This would allow an attacker to spoof DNS (for a google.com domain) and to intercept all Cloud Push notifications sent to Android devices from the application server.

Assigning to Steve to consider whether to resolve for 1.2EE or a future release. Although the timing is not ideal, the recommendation would be to resolve this for 1.2 EE.

Potential strategy for implementation:

android-sdk-macosx/extras/google/gcm/gcm-server/src/com/google/android/gcm/server/Sender.java

Just use the HttpURLConnection as in the example.

protected HttpURLConnection post(String url, String contentType, String body)
throws IOException {
if (url == null || body == null)

if (!url.startsWith("https://"))

logger.fine("Sending POST to " + url);
logger.finest("POST body: " + body);
byte[] bytes = body.getBytes();
HttpURLConnection conn = getConnection(url);
conn.setDoOutput(true);
conn.setUseCaches(false);
conn.setFixedLengthStreamingMode(bytes.length);
conn.setRequestMethod("POST");
conn.setRequestProperty("Content-Type", contentType);
conn.setRequestProperty("Authorization", "key=" + key);
OutputStream out = conn.getOutputStream();
out.write(bytes);
out.close();
return conn;
}

All SSL related code has been removed from GCM provider. Now using a normal HTTP connection. The C2DM provider has been deleted, as it is no longer supported by google.