retrofit + okhttp on android 4 ssl

Question

I found out that android 4 doesn't play well with ssl , when trying to contact an api with https it causes a crash

javax.net.ssl.SSLException: SSL handshake aborted: ssl=0xb8dbad20: I/O error during system call, Connection reset by peer

Here's what i tried from other similar questions:

   if (Build.VERSION.SDK_INT >= 16 && Build.VERSION.SDK_INT < 22) {
        try {
            Logger.e("under lolipop");
            SSLContext sc = SSLContext.getInstance("TLS");
            sc.init(null, new TrustManager[] { new MyTrustManager() }, new SecureRandom());
            client.sslSocketFactory(sc.getSocketFactory());
        } catch (Exception e) {
            Logger.e("HTTPS"+ e.getMessage() );
        }
    }

Which didn't effect the outcome

And

 if (Build.VERSION.SDK_INT >= 16 && Build.VERSION.SDK_INT < 22) {

        try {
            client.sslSocketFactory(new TLSSocketFactory(), (X509TrustManager)trustAllCerts[0])
                    .build();
            Logger.e("SETUP TRUST SSL");
            return client.build();
        } catch (KeyManagementException e) {
            Logger.e("SETUP TRUST SSL Failed "+e.getMessage());

            e.printStackTrace();
        } catch (NoSuchAlgorithmException e) {
            Logger.e("SETUP TRUST SSL Failed "+e.getMessage());

            e.printStackTrace();
        }
    }
    return client.build();

}
final TrustManager[] trustAllCerts = new TrustManager[] { new X509TrustManager() {
    @Override
    public void checkClientTrusted(
            java.security.cert.X509Certificate[] chain,
            String authType) throws CertificateException {
    }

    @Override
    public void checkServerTrusted(
            java.security.cert.X509Certificate[] chain,
            String authType) throws CertificateException {
    }

    @Override
    public java.security.cert.X509Certificate[] getAcceptedIssuers() {
        return new java.security.cert.X509Certificate[0];
    }
} };

This code gives a different error :

java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.

Is there anyway to fix this , I must support android 4 and also use https ,

Any help will do !

you can check is SSL are correctly apply at server side or not using online tool : https://www.sslshopper.com/ssl-checker.html — Vishal G. Gohel, Apr 16 '19 at 07:24
Possible duplicate of: [Retrofit not working on specific versions of android](https://stackoverflow.com/questions/55547248/retrofit-not-working-on-specific-versions-of-android) — Martin Zeitler, Apr 23 '19 at 09:17

Håvard Jakobsen · Answer 1 · 2019-04-23T18:41:35.703

I ran into a similar issue on Android 4.4 some time ago when our backend dropped support for TLS 1.0 and 1.1. I solved this by installing a new security provider with Google Play Services ProviderInstaller.

In your apps gradle.build file add

implementation "com.google.android.gms:play-services-auth:16.0.1"

In your startup Activity call ProviderInstaller.installIfNeeded() as early as possible. Here is an example method that tries to install the provider:

private static void installGooglePlayServicesProvider(Context context) {
    if (Build.VERSION.SDK_INT < Build.VERSION_CODES.LOLLIPOP) { //Devices with Android 5.1+ should support TLS 1.x out of the box
        try {
            ProviderInstaller.installIfNeeded(context);
        } catch (GooglePlayServicesRepairableException e) {
            Log.e("ProviderInstaller", "Google Play Services is out of date!", e);
            GoogleApiAvailability.getInstance().showErrorNotification(context, e.getConnectionStatusCode());
        } catch (GooglePlayServicesNotAvailableException e) {
            Log.e("ProviderInstaller", "Google Play Services is unavailable!", e);
        }
    }
}

For more information on ProviderInstaller see Goolge developer page: Patch the security provider with ProviderInstaller

When using TLS 1.2 you might have to force enable support on some devices. Take a look at the following acticle and their Tls12SocketFactory implementation: Working with TLS 1.2 on Android 4.4 and Lower

does installGooglePlayServicesProvider suppose to prompt some screen ? or it works behind the scenes ? — yanivtwin, May 15 '19 at 08:22
also , when i do the Tls12SocketFactory it doesn't work , i'm using dagger could that be the problem ? — yanivtwin, May 15 '19 at 11:25

score 1 · Answer 2 · answered Apr 23 '19 at 09:11

1

Okhttp 3.13.x has dropped support for TLS1.2 and below and only support for Android API 21+. You will have to use Okhttp 3.12.x version branch for using it with Android 4.x devices.

More here

answered Apr 23 '19 at 09:11

Aditya Ladwa

90
6

retrofit + okhttp on android 4 ssl

2 Answers2