I need to interface with an 3rd party API in Android Application (Android API 24) written in Kotlin. I've the source generated by Swagger but still I don't have a success with getting any data. Each time I call the API class I got such exception
error:10000410:SSL routines:OPENSSL_internal:SSLV3_ALERT_HANDSHAKE_FAILURE (external/boringssl/src/ssl/s3_pkt.c:610 0xa7cf3780:0x00000001)
error:1000009a:SSL routines:OPENSSL_internal:HANDSHAKE_FAILURE_ON_CLIENT_HELLO (external/boringssl/src/ssl/s3_clnt.c:764 0xa52a6266:0x00000000)
at com.android.org.conscrypt.NativeCrypto.SSL_do_handshake(Native Method)
at com.android.org.conscrypt.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:357)
... 22 more
Disconnected from the target VM, address: 'localhost:37941', transport: 'socket'
The problem is clearly caused by failed SSLv3 handshake what makes sense as this 3rd party API supports only TLS 1.3 I done some modification to auto generated ApiClient.kt class to force it to use proper TLS version with supported cipers. Unfortunately I've still got the same error. Ok HTTP seems to completely ignore the configuration I'm forcing and still tries to connect to the Endpoint using unsupported SSLv3.
companion object {
protected const val ContentType = "Content-Type"
protected const val Accept = "Accept"
protected const val JsonMediaType = "application/json"
protected const val FormDataMediaType = "multipart/form-data"
protected const val XmlMediaType = "application/xml"
@JvmStatic
val connspec: ConnectionSpec = ConnectionSpec.Builder(ConnectionSpec.MODERN_TLS)
.tlsVersions(TlsVersion.TLS_1_2)
.cipherSuites(
CipherSuite.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384)
.build();
@JvmStatic
val client: OkHttpClient = OkHttpClient.Builder().connectionSpecs(Arrays.asList(connspec))
.build();
@JvmStatic
var defaultHeaders: Map<String, String> by ApplicationDelegates.setOnce(mapOf(ContentType to JsonMediaType, Accept to JsonMediaType))
@JvmStatic
val jsonHeaders: Map<String, String> = mapOf(ContentType to JsonMediaType, Accept to JsonMediaType)
}
Could somebody guide me where to look for a root cause of that errors?
The problem has been solved some time ago and it was completely unrelated to the application code itself. As I discovered Android 7.0 has a bug in BoringSSL library which doesn't support some elliptic curves. When I've bumped the target API version the SSL exception disappeared. The problem is described here: Android - SSL/TLS and ECC (Elliptic curve cryptography)
User contributions licensed under CC BY-SA 3.0