SSLHandshakeException: violation message failed on Android N / 7.0

Question

I am working on an application for which (power) users must configure their own server (i.e. nginx) to run the backend application. The corresponding domain must be configured in the application so that it can connect. I tested primarily on my own phone (sony z3c) and started to develop for 5.1. Later I received an update for 6.0, but still supported working 5.1 inside the emulator. Not so long ago, I started working on AVD with an image for 7.0, and to my surprise, it will not connect to my server, telling me that ssl handshake failed. My nginx configuration is pretty strict, but it works for both 5.1 and 6.0, so ...?!

Here is what I know:

• I use v24 to support libs, i.e. my compileSdkVersion is 24.
• I am using Volley v1.0.0 .
• I tried TLSSocketFactory , but that doesn’t change anything. This seems to be used in most cases to prevent SSL3 from being used for older versions of the SDK.
• I tried to increase the timeout, but it does not change anything.
• I tried using the HttpURLConnection directly, but it does not change anything except the stack trace (without volleyball links, but identical otherwise).

Without a TLSSocketFactory, the request is executed using an empty request queue created using Volley.newRequestQueue(context) .

This is what I see in android studio:

 W/System.err: com.android.volley.NoConnectionError: javax.net.ssl.SSLHandshakeException: Connection closed by peer W/System.err: at com.android.volley.toolbox.BasicNetwork.performRequest(BasicNetwork.java:151) W/System.err: at com.android.volley.NetworkDispatcher.run(NetworkDispatcher.java:112) W/System.err: Caused by: javax.net.ssl.SSLHandshakeException: Connection closed by peer W/System.err: at com.android.org.conscrypt.NativeCrypto.SSL_do_handshake(Native Method) W/System.err: at com.android.org.conscrypt.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:357) W/System.err: at com.android.okhttp.Connection.connectTls(Connection.java:235) W/System.err: at com.android.okhttp.Connection.connectSocket(Connection.java:199) W/System.err: at com.android.okhttp.Connection.connect(Connection.java:172) W/System.err: at com.android.okhttp.Connection.connectAndSetOwner(Connection.java:367) W/System.err: at com.android.okhttp.OkHttpClient$1.connectAndSetOwner(OkHttpClient.java:130) W/System.err: at com.android.okhttp.internal.http.HttpEngine.connect(HttpEngine.java:329) W/System.err: at com.android.okhttp.internal.http.HttpEngine.sendRequest(HttpEngine.java:246) W/System.err: at com.android.okhttp.internal.huc.HttpURLConnectionImpl.execute(HttpURLConnectionImpl.java:457) W/System.err: at com.android.okhttp.internal.huc.HttpURLConnectionImpl.connect(HttpURLConnectionImpl.java:126) W/System.err: at com.android.okhttp.internal.huc.HttpURLConnectionImpl.getOutputStream(HttpURLConnectionImpl.java:257) W/System.err: at com.android.okhttp.internal.huc.DelegatingHttpsURLConnection.getOutputStream(DelegatingHttpsURLConnection.java:218) W/System.err: at com.android.okhttp.internal.huc.HttpsURLConnectionImpl.getOutputStream(HttpsURLConnectionImpl.java) W/System.err: at com.android.volley.toolbox.HurlStack.addBodyIfExists(HurlStack.java:264) W/System.err: at com.android.volley.toolbox.HurlStack.setConnectionParametersForRequest(HurlStack.java:234) W/System.err: at com.android.volley.toolbox.HurlStack.performRequest(HurlStack.java:107) W/System.err: at com.android.volley.toolbox.BasicNetwork.performRequest(BasicNetwork.java:96) W/System.err: ... 1 more W/System.err: Suppressed: javax.net.ssl.SSLHandshakeException: Handshake failed W/System.err: at com.android.org.conscrypt.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:429) W/System.err: ... 17 more W/System.err: Caused by: javax.net.ssl.SSLProtocolException: SSL handshake terminated: ssl=0x7ffef3748040: Failure in SSL library, usually a protocol error W/System.err: error:10000410:SSL routines:OPENSSL_internal:SSLV3_ALERT_HANDSHAKE_FAILURE (external/boringssl/src/ssl/s3_pkt.c:610 0x7ffeda1d2240:0x00000001) W/System.err: error:1000009a:SSL routines:OPENSSL_internal:HANDSHAKE_FAILURE_ON_CLIENT_HELLO (external/boringssl/src/ssl/s3_clnt.c:764 0x7ffee9d2b70a:0x00000000) W/System.err: at com.android.org.conscrypt.NativeCrypto.SSL_do_handshake(Native Method) W/System.err: at com.android.org.conscrypt.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:357) W/System.err: ... 17 more 

Since he says SSLV3_ALERT_HANDSHAKE_FAILURE , I can only assume that for some reason he is trying to connect using SSLv3 and fails, but that makes no sense to me at all. It may be an encryption problem, but how can I say what it is trying to use? I would prefer not to enable the ciphers on the server, make an attempt to connect and retry.

My nginx website uses let encryption certificate and has the following configuration:

 ssl_stapling on; ssl_stapling_verify on; ssl_trusted_certificate /etc/ssl/certs/lets-encrypt-x1-cross-signed.pem; ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:!aNULL; ssl_dhparam /etc/ssl/certs/dhparam.pem; ssl_ecdh_curve secp384r1; ssl_prefer_server_ciphers on; ssl_protocols TLSv1.2; 

To test these ciphers, I have a script , and it confirms these ciphers (runs on hoarse vps outside the server network):

 Testing ECDHE-RSA-AES256-GCM-SHA384 ... YES
 Testing ECDHE-ECDSA-AES256-GCM-SHA384 ... NO (sslv3 alert handshake failure)
 Testing ECDHE-RSA-AES256-SHA384 ... NO (sslv3 alert handshake failure)
 Testing ECDHE-ECDSA-AES256-SHA384 ... NO (sslv3 alert handshake failure)
 Testing ECDHE-RSA-AES256-SHA ... NO (sslv3 alert handshake failure)
 Testing ECDHE-ECDSA-AES256-SHA ... NO (sslv3 alert handshake failure)
 Testing SRP-DSS-AES-256-CBC-SHA ... NO (sslv3 alert handshake failure)
 Testing SRP-RSA-AES-256-CBC-SHA ... NO (sslv3 alert handshake failure)
 Testing DHE-DSS-AES256-GCM-SHA384 ... NO (sslv3 alert handshake failure)
 Testing DHE-RSA-AES256-GCM-SHA384 ... NO (sslv3 alert handshake failure)
 Testing DHE-RSA-AES256-SHA256 ... NO (sslv3 alert handshake failure)
 Testing DHE-DSS-AES256-SHA256 ... NO (sslv3 alert handshake failure)
 Testing DHE-RSA-AES256-SHA ... NO (sslv3 alert handshake failure)
 Testing DHE-DSS-AES256-SHA ... NO (sslv3 alert handshake failure)
 Testing DHE-RSA-CAMELLIA256-SHA ... NO (sslv3 alert handshake failure)
 Testing DHE-DSS-CAMELLIA256-SHA ... NO (sslv3 alert handshake failure)
 Testing AECDH-AES256-SHA ... NO (sslv3 alert handshake failure)
 Testing SRP-AES-256-CBC-SHA ... NO (sslv3 alert handshake failure)
 Testing ADH-AES256-GCM-SHA384 ... NO (sslv3 alert handshake failure)
 Testing ADH-AES256-SHA256 ... NO (sslv3 alert handshake failure)
 Testing ADH-AES256-SHA ... NO (sslv3 alert handshake failure)
 Testing ADH-CAMELLIA256-SHA ... NO (sslv3 alert handshake failure)
 Testing ECDH-RSA-AES256-GCM-SHA384 ... NO (sslv3 alert handshake failure)
 Testing ECDH-ECDSA-AES256-GCM-SHA384 ... NO (sslv3 alert handshake failure)
 Testing ECDH-RSA-AES256-SHA384 ... NO (sslv3 alert handshake failure)
 Testing ECDH-ECDSA-AES256-SHA384 ... NO (sslv3 alert handshake failure)
 Testing ECDH-RSA-AES256-SHA ... NO (sslv3 alert handshake failure)
 Testing ECDH-ECDSA-AES256-SHA ... NO (sslv3 alert handshake failure)
 Testing AES256-GCM-SHA384 ... NO (sslv3 alert handshake failure)
 Testing AES256-SHA256 ... NO (sslv3 alert handshake failure)
 Testing AES256-SHA ... NO (sslv3 alert handshake failure)
 Testing CAMELLIA256-SHA ... NO (sslv3 alert handshake failure)
 Testing PSK-AES256-CBC-SHA ... NO (no ciphers available)
 Testing ECDHE-RSA-DES-CBC3-SHA ... NO (sslv3 alert handshake failure)
 Testing ECDHE-ECDSA-DES-CBC3-SHA ... NO (sslv3 alert handshake failure)
 Testing SRP-DSS-3DES-EDE-CBC-SHA ... NO (sslv3 alert handshake failure)
 Testing SRP-RSA-3DES-EDE-CBC-SHA ... NO (sslv3 alert handshake failure)
 Testing EDH-RSA-DES-CBC3-SHA ... NO (sslv3 alert handshake failure)
 Testing EDH-DSS-DES-CBC3-SHA ... NO (sslv3 alert handshake failure)
 Testing AECDH-DES-CBC3-SHA ... NO (sslv3 alert handshake failure)
 Testing SRP-3DES-EDE-CBC-SHA ... NO (sslv3 alert handshake failure)
 Testing ADH-DES-CBC3-SHA ... NO (sslv3 alert handshake failure)
 Testing ECDH-RSA-DES-CBC3-SHA ... NO (sslv3 alert handshake failure)
 Testing ECDH-ECDSA-DES-CBC3-SHA ... NO (sslv3 alert handshake failure)
 Testing DES-CBC3-SHA ... NO (sslv3 alert handshake failure)
 Testing PSK-3DES-EDE-CBC-SHA ... NO (no ciphers available)
 Testing ECDHE-RSA-AES128-GCM-SHA256 ... YES
 Testing ECDHE-ECDSA-AES128-GCM-SHA256 ... NO (sslv3 alert handshake failure)
 Testing ECDHE-RSA-AES128-SHA256 ... NO (sslv3 alert handshake failure)
 Testing ECDHE-ECDSA-AES128-SHA256 ... NO (sslv3 alert handshake failure)
 Testing ECDHE-RSA-AES128-SHA ... NO (sslv3 alert handshake failure)
 Testing ECDHE-ECDSA-AES128-SHA ... NO (sslv3 alert handshake failure)
 Testing SRP-DSS-AES-128-CBC-SHA ... NO (sslv3 alert handshake failure)
 Testing SRP-RSA-AES-128-CBC-SHA ... NO (sslv3 alert handshake failure)
 Testing DHE-DSS-AES128-GCM-SHA256 ... NO (sslv3 alert handshake failure)
 Testing DHE-RSA-AES128-GCM-SHA256 ... NO (sslv3 alert handshake failure)
 Testing DHE-RSA-AES128-SHA256 ... NO (sslv3 alert handshake failure)
 Testing DHE-DSS-AES128-SHA256 ... NO (sslv3 alert handshake failure)
 Testing DHE-RSA-AES128-SHA ... NO (sslv3 alert handshake failure)
 Testing DHE-DSS-AES128-SHA ... NO (sslv3 alert handshake failure)
 Testing DHE-RSA-SEED-SHA ... NO (sslv3 alert handshake failure)
 Testing DHE-DSS-SEED-SHA ... NO (sslv3 alert handshake failure)
 Testing DHE-RSA-CAMELLIA128-SHA ... NO (sslv3 alert handshake failure)
 Testing DHE-DSS-CAMELLIA128-SHA ... NO (sslv3 alert handshake failure)
 Testing AECDH-AES128-SHA ... NO (sslv3 alert handshake failure)
 Testing SRP-AES-128-CBC-SHA ... NO (sslv3 alert handshake failure)
 Testing ADH-AES128-GCM-SHA256 ... NO (sslv3 alert handshake failure)
 Testing ADH-AES128-SHA256 ... NO (sslv3 alert handshake failure)
 Testing ADH-AES128-SHA ... NO (sslv3 alert handshake failure)
 Testing ADH-SEED-SHA ... NO (sslv3 alert handshake failure)
 Testing ADH-CAMELLIA128-SHA ... NO (sslv3 alert handshake failure)
 Testing ECDH-RSA-AES128-GCM-SHA256 ... NO (sslv3 alert handshake failure)
 Testing ECDH-ECDSA-AES128-GCM-SHA256 ... NO (sslv3 alert handshake failure)
 Testing ECDH-RSA-AES128-SHA256 ... NO (sslv3 alert handshake failure)
 Testing ECDH-ECDSA-AES128-SHA256 ... NO (sslv3 alert handshake failure)
 Testing ECDH-RSA-AES128-SHA ... NO (sslv3 alert handshake failure)
 Testing ECDH-ECDSA-AES128-SHA ... NO (sslv3 alert handshake failure)
 Testing AES128-GCM-SHA256 ... NO (sslv3 alert handshake failure)
 Testing AES128-SHA256 ... NO (sslv3 alert handshake failure)
 Testing AES128-SHA ... NO (sslv3 alert handshake failure)
 Testing SEED-SHA ... NO (sslv3 alert handshake failure)
 Testing CAMELLIA128-SHA ... NO (sslv3 alert handshake failure)
 Testing PSK-AES128-CBC-SHA ... NO (no ciphers available)
 Testing ECDHE-RSA-RC4-SHA ... NO (sslv3 alert handshake failure)
 Testing ECDHE-ECDSA-RC4-SHA ... NO (sslv3 alert handshake failure)
 Testing AECDH-RC4-SHA ... NO (sslv3 alert handshake failure)
 Testing ADH-RC4-MD5 ... NO (sslv3 alert handshake failure)
 Testing ECDH-RSA-RC4-SHA ... NO (sslv3 alert handshake failure)
 Testing ECDH-ECDSA-RC4-SHA ... NO (sslv3 alert handshake failure)
 Testing RC4-SHA ... NO (sslv3 alert handshake failure)
 Testing RC4-MD5 ... NO (sslv3 alert handshake failure)
 Testing PSK-RC4-SHA ... NO (no ciphers available)
 Testing EDH-RSA-DES-CBC-SHA ... NO (sslv3 alert handshake failure)
 Testing EDH-DSS-DES-CBC-SHA ... NO (sslv3 alert handshake failure)
 Testing ADH-DES-CBC-SHA ... NO (sslv3 alert handshake failure)
 Testing DES-CBC-SHA ... NO (sslv3 alert handshake failure)
 Testing EXP-EDH-RSA-DES-CBC-SHA ... NO (sslv3 alert handshake failure)
 Testing EXP-EDH-DSS-DES-CBC-SHA ... NO (sslv3 alert handshake failure)
 Testing EXP-ADH-DES-CBC-SHA ... NO (sslv3 alert handshake failure)
 Testing EXP-DES-CBC-SHA ... NO (sslv3 alert handshake failure)
 Testing EXP-RC2-CBC-MD5 ... NO (sslv3 alert handshake failure)
 Testing EXP-ADH-RC4-MD5 ... NO (sslv3 alert handshake failure)
 Testing EXP-RC4-MD5 ... NO (sslv3 alert handshake failure)
 Testing ECDHE-RSA-NULL-SHA ... NO (sslv3 alert handshake failure)
 Testing ECDHE-ECDSA-NULL-SHA ... NO (sslv3 alert handshake failure)
 Testing AECDH-NULL-SHA ... NO (sslv3 alert handshake failure)
 Testing ECDH-RSA-NULL-SHA ... NO (sslv3 alert handshake failure)
 Testing ECDH-ECDSA-NULL-SHA ... NO (sslv3 alert handshake failure)
 Testing NULL-SHA256 ... NO (sslv3 alert handshake failure)
 Testing NULL-SHA ... NO (sslv3 alert handshake failure)
 Testing NULL-MD5 ... NO (sslv3 alert handshake failure

I can open the url server in the emulator browser and get the perfect json response so that I know that the system itself is capable.

So the question is, why can't I connect to Android 7?

Update

I looked at the captured packet using tcpdump and wirehark and the activated ciphers are in ClientHello, so this should not be a problem.

 Cipher Suites (18 suites)

 Cipher Suite: Unknown (0xcca9)
 Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b)
 Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (0xc02c)
 Cipher Suite: Unknown (0xcca8)
 Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)
 Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)
 Cipher Suite: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (0x009e)
 Cipher Suite: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x009f)
 Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009)
 Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a)
 Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)
 Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)
 Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x0033)
 Cipher Suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x0039)
 Cipher Suite: TLS_RSA_WITH_AES_128_GCM_SHA256 (0x009c)
 Cipher Suite: TLS_RSA_WITH_AES_256_GCM_SHA384 (0x009d)
 Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f)
 Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035)

As you can see 0xc02f and 0xc030 , but the next TLSv1.2 package says: Alert (21), Handshake Failure (40) .

Update 2 :

These are the curves from Android 5.1 in ClientHello:

 Elliptic curves (25 curves)

 Elliptic curve: sect571r1 (0x000e)
 Elliptic curve: sect571k1 (0x000d)
 Elliptic curve: secp521r1 (0x0019)
 Elliptic curve: sect409k1 (0x000b)
 Elliptic curve: sect409r1 (0x000c)
 Elliptic curve: secp384r1 (0x0018)
 Elliptic curve: sect283k1 (0x0009)
 Elliptic curve: sect283r1 (0x000a)
 Elliptic curve: secp256k1 (0x0016)
 Elliptic curve: secp256r1 (0x0017)
 Elliptic curve: sect239k1 (0x0008)
 Elliptic curve: sect233k1 (0x0006)
 Elliptic curve: sect233r1 (0x0007)
 Elliptic curve: secp224k1 (0x0014)
 Elliptic curve: secp224r1 (0x0015)
 Elliptic curve: sect193r1 (0x0004)
 Elliptic curve: sect193r2 (0x0005)
 Elliptic curve: secp192k1 (0x0012)
 Elliptic curve: secp192r1 (0x0013)
 Elliptic curve: sect163k1 (0x0001)
 Elliptic curve: sect163r1 (0x0002)
 Elliptic curve: sect163r2 (0x0003)
 Elliptic curve: secp160k1 (0x000f)
 Elliptic curve: secp160r1 (0x0010)
 Elliptic curve: secp160r2 (0x0011)

In ServerHello, secp384r1 (0x0018) returned.

And this is from Android 7:

 Elliptic curves (1 curve)

 Elliptic curve: secp256r1 (0x0017)

As a result of a confirmation failure.

Changing the nginx configuration by removing secp384r1 or replacing it with the default (prime256v1) really makes it work. So, I think, the question remains: can I add elliptical curves?

The captured data is the same when using the emulator, as when using an Android 7.0 device (General Mobile 4G).

Update 3 :

A small update, but worth mentioning: I got it to work in the emulator using Android 7.1.1 (!). It shows the following data (again, using tcpdump and browsing using wirehark):

 Elliptic curves (3 curves)

 Elliptic curve: secp256r1 (0x0017)
 Elliptic curve: secp384r1 (0x0018)
 Elliptic curve: secp512r1 (0x0019)

It displays the same 18 Cipher Suites.

Answer 1

This is a known regression in Android 7.0, confirmed by Google and fixed sometime before the release of Android 7.1.1. Here is the error report: https://code.google.com/p/android/issues/detail?id=224438 .

To be clear, the error here is that 7.0 only supports one elliptical curve: prime256v1 aka secp256r1 aka NIST P-256, as Cornelis points out in the question. Therefore, if your users are faced with this problem, these are temporary solutions available to you (ignoring the fact that your users should ideally just upgrade to Android 7.1.1):

• Configure the server to use the prime256v1 elliptic curve. For example, in Nginx 1.10, you do this by setting ssl_ecdh_curve prime256v1; .

• If this does not work, use old cipher suites that do not rely on elliptic curve cryptography (e.g. DHE-RSA-AES256-GCM-SHA384 ) (make sure you understand what you are doing here in terms of data security)

NOTE. . I am not an expert in the field of cryptography with an elliptic curve, do not forget to conduct your own research on the impact of security on my proposals. Here are some other links that I referred to when writing this answer:

• https://community.letsencrypt.org/t/warning-android-7-0-clients-not-browsers-can-only-use-curve-prime256v1/23212
• https://github.com/nodejs/node/issues/1495

Answer 2

I had a problem with a Self-Signed Certificate and the problem was in a cipher that was not accepted by Android 7.0

I ran: openssl s_client -showcerts -connect <domain>:<port>

As a result, I found:

 Protocol : TLSv1 Cipher : DHE-RSA-AES256-SHA 

I searched for the Android equivalent of the cipher and added it to my Retrofit Restadapter:

 ConnectionSpec spec = new ConnectionSpec.Builder(ConnectionSpec.MODERN_TLS) .tlsVersions(TlsVersion.TLS_1_2) .cipherSuites( CipherSuite.TLS_DHE_RSA_WITH_AES_256_CBC_SHA) .build(); clientBuilder.connectionSpecs(Collections.singletonList(spec)); 

From here, every connection was accepted with the correct certificate pinning or the correct certificate, but with the "wrong" cipher in accordance with Android 7.0.

Looking back at this answer after a year, I must admit that I am still glad that I published it, on the other hand, if you are able to change the certificate to the correct Cypher set, please do this always instead of "downgrading" i.e. accepted sets in your application. If you need to work with a self-signed certificate (for example, for built-in), this is a working solution for you.

Answer 3

Here you are working out a solution for Volley:

before creating a queue in solid codes:

 public class VolleyServiceSingleton { private RequestQueue mRequestQueue; private HurlStack mStack; private VolleyServiceSingleton(){ SSLSocketFactoryExtended factory = null; try { factory = new SSLSocketFactoryExtended(); } catch (NoSuchAlgorithmException e) { e.printStackTrace(); } catch (KeyManagementException e) { e.printStackTrace(); } final SSLSocketFactoryExtended finalFactory = factory; mStack = new HurlStack() { @Override protected HttpURLConnection createConnection(URL url) throws IOException { HttpsURLConnection httpsURLConnection = (HttpsURLConnection) super.createConnection(url); try { httpsURLConnection.setSSLSocketFactory(finalFactory); httpsURLConnection.setRequestProperty("charset", "utf-8"); } catch (Exception e) { e.printStackTrace(); } return httpsURLConnection; } }; mRequestQueue = Volley.newRequestQueue(YourApplication.getContext(), mStack, -1); } } 

and here is SSLSocketFactoryExtended:

 public class SSLSocketFactoryExtended extends SSLSocketFactory { private SSLContext mSSLContext; private String[] mCiphers; private String[] mProtocols; public SSLSocketFactoryExtended() throws NoSuchAlgorithmException, KeyManagementException { initSSLSocketFactoryEx(null,null,null); } public String[] getDefaultCipherSuites() { return mCiphers; } public String[] getSupportedCipherSuites() { return mCiphers; } public Socket createSocket(Socket s, String host, int port, boolean autoClose) throws IOException { SSLSocketFactory factory = mSSLContext.getSocketFactory(); SSLSocket ss = (SSLSocket)factory.createSocket(s, host, port, autoClose); ss.setEnabledProtocols(mProtocols); ss.setEnabledCipherSuites(mCiphers); return ss; } public Socket createSocket(InetAddress address, int port, InetAddress localAddress, int localPort) throws IOException { SSLSocketFactory factory = mSSLContext.getSocketFactory(); SSLSocket ss = (SSLSocket)factory.createSocket(address, port, localAddress, localPort); ss.setEnabledProtocols(mProtocols); ss.setEnabledCipherSuites(mCiphers); return ss; } public Socket createSocket(String host, int port, InetAddress localHost, int localPort) throws IOException { SSLSocketFactory factory = mSSLContext.getSocketFactory(); SSLSocket ss = (SSLSocket)factory.createSocket(host, port, localHost, localPort); ss.setEnabledProtocols(mProtocols); ss.setEnabledCipherSuites(mCiphers); return ss; } public Socket createSocket(InetAddress host, int port) throws IOException { SSLSocketFactory factory = mSSLContext.getSocketFactory(); SSLSocket ss = (SSLSocket)factory.createSocket(host, port); ss.setEnabledProtocols(mProtocols); ss.setEnabledCipherSuites(mCiphers); return ss; } public Socket createSocket(String host, int port) throws IOException { SSLSocketFactory factory = mSSLContext.getSocketFactory(); SSLSocket ss = (SSLSocket)factory.createSocket(host, port); ss.setEnabledProtocols(mProtocols); ss.setEnabledCipherSuites(mCiphers); return ss; } private void initSSLSocketFactoryEx(KeyManager[] km, TrustManager[] tm, SecureRandom random) throws NoSuchAlgorithmException, KeyManagementException { mSSLContext = SSLContext.getInstance("TLS"); mSSLContext.init(km, tm, random); mProtocols = GetProtocolList(); mCiphers = GetCipherList(); } protected String[] GetProtocolList() { String[] protocols = { "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3"}; String[] availableProtocols = null; SSLSocket socket = null; try { SSLSocketFactory factory = mSSLContext.getSocketFactory(); socket = (SSLSocket)factory.createSocket(); availableProtocols = socket.getSupportedProtocols(); } catch(Exception e) { return new String[]{ "TLSv1" }; } finally { if(socket != null) try { socket.close(); } catch (IOException e) { } } List<String> resultList = new ArrayList<String>(); for(int i = 0; i < protocols.length; i++) { int idx = Arrays.binarySearch(availableProtocols, protocols[i]); if(idx >= 0) resultList.add(protocols[i]); } return resultList.toArray(new String[0]); } protected String[] GetCipherList() { List<String> resultList = new ArrayList<String>(); SSLSocketFactory factory = mSSLContext.getSocketFactory(); for(String s : factory.getSupportedCipherSuites()){ Log.e("CipherSuite type = ",s); resultList.add(s); } return resultList.toArray(new String[resultList.size()]); } } 

in these codes, I just add all the ciphers that are supported by the device, it works for me), maybe it will help someone) Cheers)

ps there is no need to add a security network configuration parameter to the manifest.

Answer 4

By default, secure connections (using the TLS and HTTPS protocols) from all applications trust the pre-installed system CAs and applications oriented to Android 6.0 (API level 23) and lower, and also trust the default CA added by the user.

This means that on Android Nougat (7.0), the game for the CA has completely changed. If you have a certificate key, you can add a network security configuration file (if you have a certificate), as described here: https://developer.android.com/training/articles/security-config.html

Or you can create your own TrustManager as described here: https://developer.android.com/training/articles/security-ssl.html#SelfSigned

Or you can enable the cipher suite that your server requires, but is not enabled by default on Android N. For example, here are two ciphers that I need to add in my application when talking to the old Windows CE server:

  SSLSocket sslsock = (SSLSocket) createSocket(); List<String> cipherSuitesToEnable = new ArrayList<>(); cipherSuitesToEnable.add("SSL_RSA_WITH_RC4_128_SHA"); cipherSuitesToEnable.add("SSL_RSA_WITH_3DES_EDE_CBC_SHA"); sslsock.setEnabledCipherSuites(cipherSuitesToEnable.toArray(new String[cipherSuitesToEnable.size()])); 

Answer 5

The same thing here. My Nginx server uses the sll_ecdh_curve prime384v1 setting. Unfortunately, a third-party guy did not allow me to configure the Nginx server after the instructions of Vicki Chijwani due to the client's privacy policy. I tried using Valley and the latest OkHttp library, but that did not help. To get around this error, I had to use WebView to communicate with the API service on Adroid 7.0 devices. Here is my adapter class. I hope someone else finds this helpful.

 /** * Connection to API service using WebView (for Android 7.0 devices) * * Created by fishbone on 09.08.17. */ @RequiresApi(api = Build.VERSION_CODES.N) class WebViewHttpsConnection extends ApiConnection { private static final long TIMEOUT = 30000; private static final String POST_DATA_SCRIPT = "javascript:(function (){" + "var xhr = new XMLHttpRequest();\n" + "xhr.open(\"POST\", \"%1$s\", true);\n" + "xhr.setRequestHeader(\"Content-type\", \"application/json\");\n" + "xhr.onreadystatechange = function () {\n" + " if (xhr.readyState === 4) {\n" + " listener.onResult(xhr.status, xhr.responseText);\n" + " }\n" + "};\n" + "xhr.send('%2$s');\n" + "})();"; WebViewHttpsConnection(Context context) { super(context); } /** * Send data to API Service. * * @param url URL of API Service * @param request JSON Object serialized into String * @return API response * @throws IOException errors */ @Override public String sendData(final URL url, final String request) throws IOException { // We should escape backslashes in JSON because JS unescape it back final String javaScript = String.format(POST_DATA_SCRIPT, url.toString(), request.replace("\\", "\\\\")); final RequestResultListener listener = new RequestResultListener(); // We must use WebView only from 'main' Thread, therefore I using Handler with Application context Handler handler = new Handler(getContext().getApplicationContext().getMainLooper()); handler.post(new Runnable() { @SuppressLint({"SetJavaScriptEnabled", "AddJavascriptInterface"}) // JavaScript is only for me and I'll use it only on Android 7.0 devices, so not scary @Override public void run() { // WebView must be created, configured and called from the same Thread final WebView webView = new WebView(getContext(), null); webView.getSettings().setJavaScriptEnabled(true); webView.addJavascriptInterface(listener, "listener"); webView.setWebViewClient(new WebViewClient() { @Override public void onPageFinished(WebView view, String url) { // As soon as loaded any page from target domain, we call JS-script that will make POST request webView.loadUrl(javaScript); } }); // I cant use postUrl() method because WebView doesn't allow to define 'Content-type' header, but my API service accepts only 'application/json' content type // To complete CORS requirements we make any GET request to lets WebView navigate to the target domain, otherwise it will send 'null' as 'Origin' in headers webView.loadUrl(url.toString()); } }); // And further we waiting for response of API service try { if (!listener.latch.await(TIMEOUT, TimeUnit.MILLISECONDS)) { throw new IOException("Timeout connection to server"); } } catch (InterruptedException e) { throw new IOException("Connection to server was interrupted"); } if (listener.code != HttpURLConnection.HTTP_OK) { throw new HttpRetryException("Server return error code " + listener.code, listener.code); } if (TextUtils.isEmpty(listener.result)) { throw new HttpRetryException("Service return empty response", listener.code); } return listener.result; } /** * Callback interface for receiving API Service response from JavaScript inside WebView */ private static class RequestResultListener { CountDownLatch latch = new CountDownLatch(1); String result = null; int code; @JavascriptInterface public void onResult(int code, String result) { this.result = result; this.code = code; latch.countDown(); } } } 

Answer 6

, "javax.net.ssl.SSLHandshakeException: Handshake fail" Android 7.0 .

onCreate() application .

 fun initializeSSLContext(mContext: Context) { try { SSLContext.getInstance("TLSv1.2") } catch (e: NoSuchAlgorithmException) { e.printStackTrace() } try { ProviderInstaller.installIfNeeded(mContext.applicationContext) } catch (e: GooglePlayServicesRepairableException) { e.printStackTrace() } catch (e: GooglePlayServicesNotAvailableException) { e.printStackTrace() } } 

Answer 7

, , ( API-, , ).

, :

 import android.content.Context; import android.os.Handler; import android.os.Looper; import android.util.Log; import android.webkit.ValueCallback; import android.webkit.WebView; import android.webkit.WebViewClient; import com.google.gson.Gson; import java.util.ArrayList; import java.util.HashMap; import java.util.List; import java.util.Map; public class BackupAPIService { private static final String TAG = "BackupAPIService"; private static BackupAPIService sService = null; // A context is required in order to run the webview. private Context mContext; // Headers for the request are stored here - they can be set, added to and removed from. private HashMap<String, String> mHeaders = new HashMap<>(); // This sets the current location of the webview - it is probably best. although generally unnecessary to set this to the main page of the API. // However not setting it at all will throw 'no access-control-allow-origin header is present' errors. private String mOriginURL = ""; // Setting a base url to the domain of the API means that any requests don't need to include this beginning of the url, // This must remain the same for all requests. private String mBaseURL = ""; public static final int GET = 0, POST = 1; // NOTE // Please note that a singleton pattern has been used, assuming all calls are made to the same API. // If you are using several APIs, you may wish to modify this service to give a separate BackupAPIService object for each. // If you are using an unknown number of APIs, you may wish to make the constructor public and remove the static methods. // The datatype returned by the API is assumed to be in JSON format - if you wish to change this, you will need to manually edit line 9 of the ajaxRequest String in the GenerateRequest method. /** * This returns the created BackupAPIService if it exists, and creates a new one otherwise. However the new one will need to be set up. * @param context is the context in which to create the WebView. This can include the context from a service. * @return the current instance of the BackupAPIService if it exists, otherwise it creates a new one. */ public static BackupAPIService getService(Context context) { if(sService == null) { sService = new BackupAPIService(context); } return sService; } /** * This allows the headers to be set for this instance of the BackupAPIService. * @param context is the context in which to create the WebView. This can include the context from a service. * @param headers are the custom headers to be sent with this request. If these already exist in the service, they will be updated. Otherwise they will be added onto the list. Please note that String headers and values should be surrounded by single quotes, ie. 'header'. To reset the headers run ResetService. * @return the current instance of the BackupAPIService if it exists, otherwise it creates a new one. */ public static BackupAPIService getService(Context context, HashMap<String, String> headers) { return getService(context).addHeaders(headers); } /** * This allows the headers and the originURL to be set for this instance of the BackupAPIService. * @param context is the context in which to create the WebView. This can include the context from a service. * @param headers are the custom headers to be sent with this request. If these already exist in the service, they will be updated. Otherwise they will be added onto the list. Please note that String headers and values should be surrounded by single quotes, ie. 'header'. To reset the headers run ResetService. * @param originURL is the URL from which the WebView will make its requests. This should be set, as the API will throw a 'no access-control-allow-origin header is present' error otherwise. * @return the current instance of the BackupAPIService if it exists, otherwise it creates a new one. */ public static BackupAPIService getService(Context context, HashMap<String, String> headers, String originURL) { return getService(context).addHeaders(headers).addOriginURL(originURL); } /** * This allows the headers and the originURL to be set for this instance of the BackupAPIService. * @param context is the context in which to create the WebView. This can include the context from a service. * @param headers are the custom headers to be sent with this request. If these already exist in the service, they will be updated. Otherwise they will be added onto the list. Please note that String headers and values should be surrounded by single quotes, ie. 'header'. To reset the headers run ResetService. * @param originURL is the URL from which the WebView will make its requests. This should be set, as the API will throw a 'no access-control-allow-origin header is present' error otherwise. * @param baseURL is the part of the API URL that never changes. This will allow you to only pass in the different URL endings as required, saving a lot of writing. * @return the current instance of the BackupAPIService if it exists, otherwise it creates a new one. */ public static BackupAPIService getService(Context context, HashMap<String, String> headers, String originURL, String baseURL) { return getService(context).addHeaders(headers).addOriginURL(originURL).addBaseURL(baseURL); } /** * This resets all of the parameters of the service to their defaults as desired. * @param resetHeaders clears the headers if set to true. * @param resetBaseURL clears the baseURL if set to true. * @param resetOriginURL clears the originURL if set to true. */ public static void ResetService(boolean resetHeaders, boolean resetBaseURL, boolean resetOriginURL) { if(sService != null) { if(resetHeaders) sService.mHeaders = new HashMap<>(); if(resetBaseURL) sService.mBaseURL = ""; if(resetOriginURL) sService.mOriginURL = ""; } } /** * This is the basic constructor for the API. * @param context is the context in which to create the WebView. This can include the context from a service. */ private BackupAPIService(Context context) { this.mContext = context; } /** * This allows the headers to be updated with the headers in the object that is sent. Existing headers in the list will be updated with their new values, and new headers will be added. Please note that String headers and values should be surrounded by single quotes, ie. 'header'. This can be done programmatically using the getCompatibleString method. * @param headers are the headers being added. * @return the current BackupAPIService object. */ public BackupAPIService addHeaders(HashMap<String, String> headers) { this.mHeaders.putAll(headers); return this; } /** * This allows a single header to be added if it does not exist, or updated if it does. * @param key is the name of the header. Please note that String headers and values should be surrounded by single quotes, ie. 'header'. * @param value is the value of the header as a String. * @return the current BackupAPIService object. */ public BackupAPIService addHeader(String key, String value) { this.mHeaders.put(key, value); return this; } /** * This allows a single header to be removed if it exists in the service * @param key is the name of the header * @return the current BackupAPIService object */ public BackupAPIService removeHeader(String key) { this.mHeaders.remove(key); return this; } /** * This returns whether a variable with a given name exists in the Service * @param key is the name of the header * @return the current BackupAPIService object */ public boolean getHeaderExists(String key) { return mHeaders.containsKey(key); } /** * This sets the originURL, which tells the API which website the request is coming from. If this is not set, the request is likely to be blocked. * @param originURL is the URL stating which website the request is coming from: you may wish to set this to the main website address of your API. * @return the current BackupAPIService object */ public BackupAPIService addOriginURL(String originURL) { mOriginURL = originURL; return this; } /** * This sets the baseURL. If there is a common URL beginning for all your API calls, you can set it here and the just send the rest of the address in your calls to the Post or Get methods. * @param baseURL will be added onto the beginning of all of the API URL requests, allowing you to avoid having to write this each time, and send shorter requests. * @return the current BackupAPIService object */ public BackupAPIService addBaseURL(String baseURL) { mBaseURL = baseURL; return this; } /** * This allows a post request to be sent, with the parameters as a hashmap. Please note that String parameters should take the format String param = "'{param}'", so that ajax recognises the String as a String - the getCompatibleString method can be used to automatically adds these single quotes to a given String. * @param URL is the url of the request - this could just be the second half of the url, if the first half has been set as the baseURL. * @param parameters is a hashmap of the parameters. * @param ajaxHandler allows you to define your own custom response with the returned information. */ public void Post(String URL, HashMap<String, String> parameters, AjaxHandler ajaxHandler) { Launch(POST, URL, ajaxHandler, parameters); } /** * This allows a get request to be sent. * @param URL is the url of the request - this could just be the second half of the url, if the first half has been set as the baseURL. * @param ajaxHandler allows you to define your own custom response with the returned information. */ public void Get(String URL, AjaxHandler ajaxHandler) { Launch(GET, URL, ajaxHandler); } /** * This is used by the public Post and Get methods to launch a request. * @param launchType is defined as either post or get by the POST and GET static constants. * @param URL is the url of the request - this could just be the second half of the url, if the first half has been set as the baseURL. * @param ajaxHandler allows you to define your own custom response with the returned information. * @param parameters is an optional hashmap of the parameters for a post request. */ private void Launch(final int launchType, final String URL, final AjaxHandler ajaxHandler, final HashMap<String, String> ... parameters) { // This piece of code is required in order to allow the WebView to run from a service without throwing errors Handler handler = new Handler(Looper.getMainLooper()); try { handler.post( new Runnable() { @Override public void run() { GenerateRequest(launchType, URL, ajaxHandler, parameters); } }); } catch (Exception e) { e.printStackTrace(); } } /** * This method generates the actual request. * @param launchType is defined as either post or get by the POST and GET static constants. * @param URL is the url of the request - this could just be the second half of the url, if the first half has been set as the baseURL. * @param ajaxHandler allows you to define your own custom response with the returned information. * @param parameters is an optional hashmap of the parameters for a post request. */ private void GenerateRequest(int launchType, String URL, AjaxHandler ajaxHandler, HashMap<String, String> ... parameters) { String importAjax = "<script src='https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js'></script>"; String customiseAjaxHeaders = "$.ajaxSetup({headers: { "; for (Map.Entry<String, String> entry : mHeaders.entrySet()) { customiseAjaxHeaders += entry.getKey() + ": " + entry.getValue() + ", "; } customiseAjaxHeaders = customiseAjaxHeaders.substring(0, customiseAjaxHeaders.length()-2) + "}});"; String postParameters = ""; if(parameters.length>0) { for (Map.Entry<String, String> entry : parameters[0].entrySet()) { postParameters += entry.getKey() + ": " + entry.getValue() + ", "; } postParameters = postParameters.substring(0, postParameters.length()-2); } //String origin = "'app.cleopatra.im'"; String requestAddress = "'"+mBaseURL + URL + "'"; String requestType = "Get"; if(launchType == POST) requestType = "Post"; String ajaxRequest = customiseAjaxHeaders + " var saveData = " + "$.ajax" + "(" + "{" + "type: '" + requestType + "'," + "url: " + requestAddress + ", " + "data: " + "{" + postParameters + "}," + "dataType: 'json'," + "success: function(data)" + "{" + "ajaxHandler.handleResults(JSON.stringify(data));" + // This runs the ajax handler created below when the handler successfully returns data "}," + "error:function(request, status)" + "{" + "ajaxHandler.handleFailure('Request Failed: ' + JSON.stringify(request) + ' due to: ' + JSON.stringify(status));" + // This runs the ajax handler created below when the handler unsuccessfully returns data "}" + "}" + ");"; CreateRequestThroughWebView(importAjax, ajaxRequest, ajaxHandler); } /** * This is used to create the generated request through a webview object * @param content is the html content of the webview - in this implementation it is currently just an import script for JQuery * @param request is the Ajax request script to be run on the webview * @param ajaxHandler allows you to define your own custom response with the returned information. */ private void CreateRequestThroughWebView(String content, final String request, AjaxHandler ajaxHandler) { Log.i(TAG, "Content: " + content + "\nRequest: " + request); HashMap<String, String> headers = new HashMap<>(); // create the new webview - this can run invisibly WebView webView = new WebView(mContext); webView.getSettings().setAllowUniversalAccessFromFileURLs(true); // This creates a webpage at the expected location, which can be accept AJAX commands webView.loadDataWithBaseURL(mOriginURL, content, "text/html; charset=utf-8", "utf-8", mOriginURL); // Allow JavaScript to run on the page webView.getSettings().setJavaScriptEnabled(true); // Add a JavaScript interface allowing completed AJAX requests to run Java methods webView.addJavascriptInterface(ajaxHandler, "ajaxHandler"); // override onPageFinished method of WebViewClient to handle AJAX calls webView.setWebViewClient(new WebViewClient() { @Override public void onPageFinished(WebView view, String url) { super.onPageFinished(view, url); // Run the JavaScript command once the page has loaded view.evaluateJavascript(request, new ValueCallback<String>() { @Override public void onReceiveValue(String s) { Log.i(TAG, "Request Completed: " + s); } }); } }); } /** * This adds additional single quotes to enclose a string representing a header name, header value, variable name or variable value, so it is still recognised as a String when it is passed into Ajax. * @param string is the header name, header value, variable name or variable value to be modified. * @return an ajax compatible String. */ public static String getCompatibleString(String string) { return "'" + string + "'"; } /** * This adds additional single quotes to enclose two strings representing either a String header name and its value, or posted variable name and its value, so that they are both still recognised as Strings when they are passed into Ajax. * @param name is the header or variable name, header value, variable name or variable value to be modified. * @param value is the header or variable value to be modified. * @return an ajax compatible HashMap which can also be added into any existing HashMaps as necessary. */ public static HashMap<String, String> getCompatibleHashMapEntry(String name, String value) { HashMap<String, String> result = new HashMap<String, String>(); result.put(getCompatibleString(name), getCompatibleString(value)); return result; } /** * This adds additional single quotes to enclose an arbitrary number of two string arrays, each representing String header name and its value, or a posted variable name and its value so that they are both still recognised as Strings when they are passed into Ajax. This is returned as a hashmap ready to be set as the necessary headers or variables for the request. * @param nameValuePairs is the header or variable name, header value, variable name or variable value to be modified. * @return an ajax compatible HashMapEntry. */ public static HashMap<String, String> getCompatibleHashMap(String[] ... nameValuePairs) { HashMap<String, String> results = new HashMap<>(); for (String[] nameValuePair: nameValuePairs) { results.put(getCompatibleString(nameValuePair[0]), getCompatibleString(nameValuePair[1])); } return results; } /** * This deals with the results of the Ajax API request. * The handleResults method of this abstracted Ajax Javascript Interface should be implemented in order to define your app behaviour when the request completes. * The ConvertResultToObject method can also be used within the handleResults method in order to convert the received json string into the corresponding class. * The handleFailure method is called if the Ajax request fails. */ public abstract static class AjaxHandler { private static final String TAG = "ajaxHandler"; private final Context context; public AjaxHandler(Context context) { this.context = context; } /** * Overwrite this method to handle the response to your request * @param results is a String representation of the result from the WebView Query */ @android.webkit.JavascriptInterface public abstract void handleResults(String results); /** * Overwrite this method to handle any failed requests * @param message is a String representation of the failure message from the WebView Query */ @android.webkit.JavascriptInterface public abstract void handleFailure(String message); /** * This should generate a predefined class object from a JSON response. It was not used in the final implementation, so it has not been tested and may need tweaking * @param json is the json representation of the class * @param classOfT is the class of the object to be populated * @return an object of class T created from the JSON string */ public <T> T ConvertResultToObject(String json, Class<T> classOfT) { Gson gson = new Gson(); return gson.fromJson(json, classOfT); } } } 

:

 // Example Ajax Implementation // Setup basic variables // Set up context Context context = this.context; // Set the beginning of the URL which is the same for all API requests String API_URL = "https://mywebsite.com/myapi/"; // Set up the url from which requests should originate String BASE_URL = "www.mywebsite.com"; // Set up variables to pass into the requests // Header names and values String API_KEY_NAME = "{API_KEY_NAME}"; String API_KEY_VALUE = "{API_KEY_VALUE}"; // Parameter names and values String USER_NAME = "User"; String USER_VALUE = "{User name}"; String PASSWORD_NAME = "Password"; String PASSWORD_VALUE = "{User Password}"; String USER_ID_NAME = "User_id"; int USER_ID_VALUE = 7; // Note that Strings need an extra set of single quotes to be recognised as a String when passed into Ajax. Methods have been provided which do that. // Get the headers as a HashMap, and convert both name and value to an Ajax compatible String HashMap<String, String> headers = BackupAPIService.getCompatibleHashMapEntry(API_KEY_NAME, API_KEY_VALUE); // Get the parameters as a HashMap, and convert the appropriate names and values to Ajax compatible Strings HashMap<String, String> parameters = BackupAPIService.getCompatibleHashMap(new String[] {USER_NAME, USER_VALUE}, new String[] {PASSWORD_NAME, PASSWORD_VALUE}); // Add the parameters where the values are not Strings parameters.put(BackupAPIService.getCompatibleString(USER_ID_NAME), USER_ID_VALUE+""); // Create or get service BackupAPIService backupService = BackupAPIService.getService(context, headers, BASE_URL, API_URL); // Post a request with the necessary addition to the API url set earlier for this request, the parameters set above, and an implementation of AjaxHandler which handles the results and failures as you desire backupService.Post("user", parameters, new BackupAPIService.AjaxHandler(context){ @Override public void handleResults(String results) { Log.e(TAG, "Success!! " + results); } @Override public void handleFailure(String message) { Log.e(TAG, "Failure :( " + message); } });