3

When downloading a file from a secured area via HTTPS, the file download in Android Download Manager hangs. It displays that it would download the file and then do nothing.

Android 4.1.2 Jelly Bean

Default Browser (Chrome)

Interestingly, HTTPS downloads from other sites would work. So no general SSL issue. All the companies mobile phones are affected. It's not a phone problem. All downloads are affected. It's not the file. It works when using Firefox instead of Chrome. And it works with chrome on iOS.

It's the standard smartphone for several thousand employees. So installing firefox is not an option. Updates are not an option.

I first thought that the Download Manager would lose the session. So I put a debug proxy in between. The session information is passed correctly. The request looks good.

GET /static/documents/testfile.pdf HTTP/1.1
Host: acmeintranet.acme.com
Connection: keep-alive
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Linux; Android 4.1.2; HUAWEI G525-U00 Build/HuaweiG525-U00)     AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.93 Mobile Safari/537.36
Referer: https://acmeintranet.acme.com/en/mob/ittest-page.htm
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-GB,en-US;q=0.8,en;q=0.6
Cookie: EdgeAccessCookie=FooFooFooFoo...

Even the response is exactly the same as the response that I get from a browser. With the debug proxy in between the server and the android smart phone, the download works. To me it looks like the difference is only the SSL certificate. When I use the debug proxy with SSL decrypt in the middle, the proxy uses the original ssl certificate. The android phone will get a certificate from the debug proxy.

Maybe there is a problem with certain certificates or certificate types?

1 Answers1

1

We did find the solution.

The problem was, that the IP address was used fpr multiple domains. Each domain had an own certificate.

The bowser would use SNI to tell the server wich certificate is needed. If that information does not come, the server will send the default certificate. In our case it was the wrong one. So the certificate did not match the domain and the download hung.

In fact older android versions don't supprt SNI.

Android SSL - SNI support

Community
  • 1
  • 1
  • The problem, in fact is Android Download Manager not having [SNI](https://en.wikipedia.org/wiki/Server_Name_Indication) support. – jap1968 Jan 05 '16 at 12:07