I'm making an app for Android 4.4 and above, and I'm trying to do an https request, I first tried with Retrofit and it gives me this:
V/error: javax.net.ssl.SSLHandshakeException: Handshake failed
I thoug it was something about the Retrofit API, but later I tried with Volley and it gives me this:
SSL handshake aborted: ssl=0xf311e9c8: Failure in SSL library, usually a protocol error
error:10000410:SSL routines:OPENSSL_internal:SSLV3_ALERT_HANDSHAKE_FAILURE (third_party/openssl/boringssl/src/ssl/tls_record.cc:562 0xd4fba9c8:0x00000001)
error:1000009a:SSL routines:OPENSSL_internal:HANDSHAKE_FAILURE_ON_CLIENT_HELLO (third_party/openssl/boringssl/src/ssl/handshake.cc:464 0xd7936bd8:0x00000000)
12-29 16:37:53.551 13763-14823/xxx.xxx.xx I/qtaguid: Untagging socket 47
12-29 16:37:53.571 13763-13763/xxx.xx.xx V/error: javax.net.ssl.SSLHandshakeException: Handshake failed
In fact, is the same issue, I don't know if I need add something to my app, due this request works perfectly with postman.
The weird thing is, before we migrate the services to the new server, I was working with a server with HTTP and it works perfectly. I don't know what I must add about security to my app.
Related
I'm using volley in my app and send request to my server but i got this error from my onErrorResponse volley:
Error: com.android.volley.NoConnectionError: javax.net.ssl.SSLHandshakeException: Read error: ssl=0xb4000071bca8e448: Failure in SSL library, usually a protocol error
error:10000438:SSL routines:OPENSSL_internal:TLSV1_ALERT_INTERNAL_ERROR (external/boringssl/src/ssl/tls_record.cc:587 0xb4000071bca09588:0x00000001)
I'm using device with android 11 and the request does not work what should i do?
Make sure you have connected to wifi
This question already has answers here:
Trust Anchor not found for Android SSL Connection
(22 answers)
Closed 2 years ago.
EDIT
It does not seem to be a duplicate to me since all the other questions are related with repeatable issues and not intermittent like this one
END-EDIT
I have an app that runs some HTTP GET.
The app runs on API 21+.
It works fine most of the time, but very rarely one HTTP GET fails with the error:
D/OkHttp: --> GET https://url/url2?parm1=value1
D/OkHttp: --> END GET
D/OkHttp: <-- HTTP FAILED: javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
When this starts happening, it keeps happening until I kill the app.
I'm using Retrofit with OKHttp 4.3.1. I'm going to update to the latest version now just in case this is a bug in OKHttp but I didn't find any report.
The code for the HTTP call is the usual code with Retrofit:
private val retrofit: Retrofit
get() = Retrofit.Builder()
.baseUrl(BuildConfig.BASE_URL)
.addConverterFactory(GsonConverterFactory.create(gson))
.addCallAdapterFactory(CoroutineCallAdapterFactory())
.client(client)
.build()
internal val service: AppService
get() = retrofit.create<AppService>(AppService::class.java)
internal interface AppService {
#GET
suspend fun loadServerListAsync(#Url url: String): Response<List<Server>>
}
In the past I have seen this error in another app. In that case the error wasn't intermittent and the problem was on the backend: they had changed a certificate, but they hadn't updated all the intermediate certificates.
In this case it looks like the error is different since it is intermittent and killing the app fixes it. There is no load balancer on the backend so it can't be that different servers have different certificates.
It can be related from cypher security protocol TLSv1 to fail and fallback to deprecated SSLv3.
To prevent TLSv1 secure connection to fallback to SSLv3 in simulator and throw connection error because SSLv3 is now deprecated and unsecure (Android Studio Failure in SSL library, usually a protocol error)
Install updated security provider using Google Play Services.
This effectively gives your app access to a newer version of OpenSSL and Java Security Provider, which includes support for TLSv1.2 in SSLEngine.
Once the new provider is installed, you can create an SSLEngine which supports SSLv3, TLSv1, TLSv1.1 and TLSv1.2 the usual way.
This should be the answer to your problem : Javax.net.ssl.SSLHandshakeException: javax.net.ssl.SSLProtocolException: SSL handshake aborted: Failure in SSL library, usually a protocol error
I am connecting to a server which has TLS support with SSL certs. I am getting a SSL Handshake error on Android app client. I also use useTransportSecurity() to deal with TLS negotiation type. Is there any workaround to get away with this error without certificate pinning?
Error encountered:
Caused by: java.lang.RuntimeException: protocol negotiation failed
at io.grpc.okhttp.OkHttpProtocolNegotiator.negotiate(OkHttpProtocolNegotiator.java:96)
at io.grpc.okhttp.OkHttpProtocolNegotiator$AndroidNegotiator.negotiate(OkHttpProtocolNegotiator.java:147)
at io.grpc.okhttp.OkHttpTlsUpgrader.upgrade(OkHttpTlsUpgrader.java:63)
at io.grpc.okhttp.OkHttpClientTransport$2.run(OkHttpClientTransport.java:474)
at io.grpc.internal.SerializingExecutor.run(SerializingExecutor.java:123)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1162)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:636)
at java.lang.Thread.run(Thread.java:764)
And this is how I generate my channel :
ManagedChannel mChannel = OkHttpChannelBuilder.forAddress(host, port)
.useTransportSecurity()
.build();
Appreciate your time and help.
ALPN is failing during the TLS handshake, which prevents gRPC from negotiating HTTP/2. Either you aren't connecting to a gRPC / HTTP/2 server or your client's TLS library is too old.
Please review the SECURITY.md documentation. Namely, you probably want to "install" the Play Services Dynamic Security Provider into the runtime when your app starts.
it might be rather a matter how you create the server; see SECURITY.md for Mutual TLS ...
Server server = NettyServerBuilder.forPort(8443)
.sslContext(GrpcSslContexts.forServer(certChainFile, privateKeyFile)
.trustManager(clientCAsFile)
.clientAuth(ClientAuth.REQUIRE)
.build());
Answering my own question.
This error comes from the ALPN TLS extension, which I needed my SSL endpoint to support. I was using NPN, and that is why I was unable to connect.
Posted by Carl Mastrangelo in grpc.io google groups
I want to make volley https request, and I have use code from here to remove SSL3 protocol and using TLSv1.2 for android >=4.4 and TLS for Android<4.4, but sometimes when I make request this error appear :
javax.net.ssl.SSLHandshakeException:
javax.net.ssl.SSLProtocolException: SSL handshake terminated:
ssl=0x606cfb30: Failure in SSL library, usually a protocol error
error:1409443E:SSL routines:SSL3_READ_BYTES:tlsv1 alert inappropriate
fallback (external/openssl/ssl/s3_pkt.c:1256 0x5fee2098:0x00000003)
anybody can help ?
Note : That error only appear in some device with Android 4.4, some other device with Android 4.4 is working well without that error.
Finally, I found it by myself, that just the problem when using slow connection, so when the connection timeout volley handshake will failed (volley connection time out is so fast), so I try to added Volley time out to 10000 ms, like this :
jsonRequest.setRetryPolicy(new DefaultRetryPolicy(10000,
DefaultRetryPolicy.DEFAULT_MAX_RETRIES,
DefaultRetryPolicy.DEFAULT_BACKOFF_MULT));
And now my app working in device that use slow connection too.
I am attempting to use the FileTransfer plugin on phonegap which works fine on some Android devices however on others the request is being cancelled and the server is is logging an SNI error:
Hostname X provided via SNI, but no hostname provided in HTTP request
This is what the client is failing on. The stream is cancelled:
D/FileTransfer(15642): java.io.IOException: stream was reset: CANCEL
D/FileTransfer(15642): at com.squareup.okhttp.internal.spdy.SpdyStream$SpdyDataOutputStream.waitUntilWritable(SpdyStream.java:664)
D/FileTransfer(15642): at com.squareup.okhttp.internal.spdy.SpdyStream$SpdyDataOutputStream.writeFrame(SpdyStream.java:640)
D/FileTransfer(15642): at com.squareup.okhttp.internal.spdy.SpdyStream$SpdyDataOutputStream.write(SpdyStream.java:601)
D/FileTransfer(15642): at org.apache.cordova.filetransfer.FileTransfer$1.run(FileTransfer.java:417)
D/FileTransfer(15642): at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1112)
D/FileTransfer(15642): at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:587)
D/FileTransfer(15642): at java.lang.Thread.run(Thread.java:864)
I have tried everything, including manually specifying the corrent host as a Host header and I have seen no results.
Is there something I am missing?
Again, the exact same JS and server-side code runs fine on other Android devices and iOS devices.