I'm using volley in my app and send request to my server but i got this error from my onErrorResponse volley:
Error: com.android.volley.NoConnectionError: javax.net.ssl.SSLHandshakeException: Read error: ssl=0xb4000071bca8e448: Failure in SSL library, usually a protocol error
error:10000438:SSL routines:OPENSSL_internal:TLSV1_ALERT_INTERNAL_ERROR (external/boringssl/src/ssl/tls_record.cc:587 0xb4000071bca09588:0x00000001)
I'm using device with android 11 and the request does not work what should i do?
Make sure you have connected to wifi
I am connecting to a server which has TLS support with SSL certs. I am getting a SSL Handshake error on Android app client. I also use useTransportSecurity() to deal with TLS negotiation type. Is there any workaround to get away with this error without certificate pinning?
Error encountered:
Caused by: java.lang.RuntimeException: protocol negotiation failed
at io.grpc.okhttp.OkHttpProtocolNegotiator.negotiate(OkHttpProtocolNegotiator.java:96)
at io.grpc.okhttp.OkHttpProtocolNegotiator$AndroidNegotiator.negotiate(OkHttpProtocolNegotiator.java:147)
at io.grpc.okhttp.OkHttpTlsUpgrader.upgrade(OkHttpTlsUpgrader.java:63)
at io.grpc.okhttp.OkHttpClientTransport$2.run(OkHttpClientTransport.java:474)
at io.grpc.internal.SerializingExecutor.run(SerializingExecutor.java:123)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1162)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:636)
at java.lang.Thread.run(Thread.java:764)
And this is how I generate my channel :
ManagedChannel mChannel = OkHttpChannelBuilder.forAddress(host, port)
.useTransportSecurity()
.build();
Appreciate your time and help.
ALPN is failing during the TLS handshake, which prevents gRPC from negotiating HTTP/2. Either you aren't connecting to a gRPC / HTTP/2 server or your client's TLS library is too old.
Please review the SECURITY.md documentation. Namely, you probably want to "install" the Play Services Dynamic Security Provider into the runtime when your app starts.
it might be rather a matter how you create the server; see SECURITY.md for Mutual TLS ...
Server server = NettyServerBuilder.forPort(8443)
.sslContext(GrpcSslContexts.forServer(certChainFile, privateKeyFile)
.trustManager(clientCAsFile)
.clientAuth(ClientAuth.REQUIRE)
.build());
Answering my own question.
This error comes from the ALPN TLS extension, which I needed my SSL endpoint to support. I was using NPN, and that is why I was unable to connect.
Posted by Carl Mastrangelo in grpc.io google groups
I'm making an app for Android 4.4 and above, and I'm trying to do an https request, I first tried with Retrofit and it gives me this:
V/error: javax.net.ssl.SSLHandshakeException: Handshake failed
I thoug it was something about the Retrofit API, but later I tried with Volley and it gives me this:
SSL handshake aborted: ssl=0xf311e9c8: Failure in SSL library, usually a protocol error
error:10000410:SSL routines:OPENSSL_internal:SSLV3_ALERT_HANDSHAKE_FAILURE (third_party/openssl/boringssl/src/ssl/tls_record.cc:562 0xd4fba9c8:0x00000001)
error:1000009a:SSL routines:OPENSSL_internal:HANDSHAKE_FAILURE_ON_CLIENT_HELLO (third_party/openssl/boringssl/src/ssl/handshake.cc:464 0xd7936bd8:0x00000000)
12-29 16:37:53.551 13763-14823/xxx.xxx.xx I/qtaguid: Untagging socket 47
12-29 16:37:53.571 13763-13763/xxx.xx.xx V/error: javax.net.ssl.SSLHandshakeException: Handshake failed
In fact, is the same issue, I don't know if I need add something to my app, due this request works perfectly with postman.
The weird thing is, before we migrate the services to the new server, I was working with a server with HTTP and it works perfectly. I don't know what I must add about security to my app.
Given an Android app that uses httpclient to connect to a third party web site, how can I get a successful SSL connection from an older Android device?
Earlier, both current and older Android versions worked, but the third party web site changed their SSL configuration. This precipitated an error, but only on the older Android platforms:
System.err: javax.net.ssl.SSLException: Connection closed by peer
System.err: at com.android.org.conscrypt.NativeCrypto.SSL_do_handshake(Native Method)
System.err: at com.android.org.conscrypt.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:406)
After doing some research (google issue tracker), I thought I might try to remove SSLv3 from the list of available protocols. I have been able to do that, and also have narrowed the number of cipher suites, but still have the SSLException problem.
The code, which uses httpclient-4.4.1.2, is patched to allow SNI, and works on newer Android (API 22), but not on an older Android (API 15) is this:
nHttpclient = HttpClientBuilder.create().setRedirectStrategy(new LaxRedirectStrategy()).setDefaultCookieStore(nCookieStore).build();
Here is some code I've been experimenting with. Although I am able to remove SSLv3, I'm still unable to establish a secure connection:
HttpClientBuilder clientBuilder = HttpClientBuilder.create();
SSLContextBuilder contextBuilder = SSLContextBuilder.create();
contextBuilder.useProtocol("TLSv1");
SSLContext sslContext = contextBuilder.build();
clientBuilder.setSslcontext(sslContext);
nHttpclient = clientBuilder.setRedirectStrategy(new LaxRedirectStrategy()).setDefaultCookieStore(nCookieStore).build();
The above code limits the protocols to include TLSv1 (no longer includes SSLv3. Also, I have temporarily altered SSLConnectionSocketFactory.createLayeredSocket() so that the socket only includes cipher suites included in both new and old Android platforms. In other words, I removed a bunch of suites that were not reported as available on a new Android platform.
So, limiting to TLSv1 and limiting to newer cipher suites, I'm still getting the error and am not able to establish a secure connection.
Logging on older Android:
cz.msebera.android.httpclient.conn.ssl.SSLConnectionSocketFactory: Enabled protocols: [TLSv1]
cz.msebera.android.httpclient.conn.ssl.SSLConnectionSocketFactory: !!Enabled cipher suites:[TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
cz.msebera.android.httpclient.conn.ssl.SSLConnectionSocketFactory: Starting handshake
cz.msebera.android.httpclient.impl.conn.DefaultManagedHttpClientConnection: http-outgoing-1: Shutdown connection
cz.msebera.android.httpclient.impl.execchain.MainClientExec: Connection discarded
cz.msebera.android.httpclient.impl.conn.DefaultManagedHttpClientConnection: http-outgoing-1: Close connection
The same code running on newer Android:
cz.msebera.android.httpclient.conn.ssl.SSLConnectionSocketFactory: Enabled protocols: [TLSv1, TLSv1.1, TLSv1.2]
cz.msebera.android.httpclient.conn.ssl.SSLConnectionSocketFactory: Enabled cipher suites:[TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, SSL_RSA_WITH_RC4_128_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
cz.msebera.android.httpclient.conn.ssl.SSLConnectionSocketFactory: Starting handshake
cz.msebera.android.httpclient.conn.ssl.SSLConnectionSocketFactory: Secure session established
Summary
It must be a common problem to enable older Android platforms to be able to use httpclient-4.4.1.2 (or similar) when the sites being accessed have been updated to newer SSL/TLS standards.
My experiments with API 15 indicate that having httpclient code that manages SNI, where SSLv3 is removed, and where older cipher suites are removed still does not allow a secure connection, but instead throws a SSLException in SSL_do_handshake().
If I try to force the old Android to use TLSv1.1, I get:
java.security.NoSuchAlgorithmException: SSLContext TLSv1.1 implementation not found
My research indicates that API 15 or lower is just never going to work with TLSv1.1 and higher, but that API 16 through API 19 might work, but the newer protocol is not enabled by default. API 20 and higher, the newer protocol is enabled by default.
What needs to be done to allow a secure connection from httpclient on Android OS's in the API 16 range?
The problem is that httpclient-android code uses getEnabledProtocols() instead of getSupportedProtocols().
The work around that I employed was to get the source code for smarek httpclient-android, pull that into a module of my project, remove the reference to the pre-built version of httpclient-android, then change one line in SSLConnectionSocketFactory.java :
//final String[] allProtocols = sslsock.getEnabledProtocols();
final String[] allProtocols = sslsock.getSupportedProtocols();
This had the effect of allowing connection to the third party web site I was trying to access on API's 16, 17, 18 and 19.
I think that Accessing TLSv1.1 or TLSV1.2 from API 15 or less is "impossible" unless you're willing to do some serious changes at the Android OS level.
But this simple change allows apps running on older Android versions to access sites that no longer support older SSL and TLSv1.
I want to make volley https request, and I have use code from here to remove SSL3 protocol and using TLSv1.2 for android >=4.4 and TLS for Android<4.4, but sometimes when I make request this error appear :
javax.net.ssl.SSLHandshakeException:
javax.net.ssl.SSLProtocolException: SSL handshake terminated:
ssl=0x606cfb30: Failure in SSL library, usually a protocol error
error:1409443E:SSL routines:SSL3_READ_BYTES:tlsv1 alert inappropriate
fallback (external/openssl/ssl/s3_pkt.c:1256 0x5fee2098:0x00000003)
anybody can help ?
Note : That error only appear in some device with Android 4.4, some other device with Android 4.4 is working well without that error.
Finally, I found it by myself, that just the problem when using slow connection, so when the connection timeout volley handshake will failed (volley connection time out is so fast), so I try to added Volley time out to 10000 ms, like this :
jsonRequest.setRetryPolicy(new DefaultRetryPolicy(10000,
DefaultRetryPolicy.DEFAULT_MAX_RETRIES,
DefaultRetryPolicy.DEFAULT_BACKOFF_MULT));
And now my app working in device that use slow connection too.