SSLProtocolException (OkHttp 3 on Android) thrown during SSLv3 handshake when the app should use TLS

0

I need to interface with an 3rd party API in Android Application (Android API 24) written in Kotlin. I've the source generated by Swagger but still I don't have a success with getting any data. Each time I call the API class I got such exception

    error:10000410:SSL routines:OPENSSL_internal:SSLV3_ALERT_HANDSHAKE_FAILURE (external/boringssl/src/ssl/s3_pkt.c:610 0xa7cf3780:0x00000001)
    error:1000009a:SSL routines:OPENSSL_internal:HANDSHAKE_FAILURE_ON_CLIENT_HELLO (external/boringssl/src/ssl/s3_clnt.c:764 0xa52a6266:0x00000000)
        at com.android.org.conscrypt.NativeCrypto.SSL_do_handshake(Native Method)
        at com.android.org.conscrypt.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:357)
            ... 22 more
Disconnected from the target VM, address: 'localhost:37941', transport: 'socket'

The problem is clearly caused by failed SSLv3 handshake what makes sense as this 3rd party API supports only TLS 1.3 I done some modification to auto generated ApiClient.kt class to force it to use proper TLS version with supported cipers. Unfortunately I've still got the same error. Ok HTTP seems to completely ignore the configuration I'm forcing and still tries to connect to the Endpoint using unsupported SSLv3.

    companion object {
        protected const val ContentType = "Content-Type"
        protected const val Accept = "Accept"
        protected const val JsonMediaType = "application/json"
        protected const val FormDataMediaType = "multipart/form-data"
        protected const val XmlMediaType = "application/xml"

        @JvmStatic
        val connspec: ConnectionSpec = ConnectionSpec.Builder(ConnectionSpec.MODERN_TLS)
                .tlsVersions(TlsVersion.TLS_1_2)
                .cipherSuites(
                        CipherSuite.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384)
                .build();

        @JvmStatic
        val client: OkHttpClient = OkHttpClient.Builder().connectionSpecs(Arrays.asList(connspec))
                .build();

        @JvmStatic
        var defaultHeaders: Map<String, String> by ApplicationDelegates.setOnce(mapOf(ContentType to JsonMediaType, Accept to JsonMediaType))

        @JvmStatic
        val jsonHeaders: Map<String, String> = mapOf(ContentType to JsonMediaType, Accept to JsonMediaType)
    }

Could somebody guide me where to look for a root cause of that errors?

android
kotlin
ssl
okhttp
asked on Stack Overflow Dec 16, 2020 by Mateusz L

1 Answer

0

The problem has been solved some time ago and it was completely unrelated to the application code itself. As I discovered Android 7.0 has a bug in BoringSSL library which doesn't support some elliptic curves. When I've bumped the target API version the SSL exception disappeared. The problem is described here: Android - SSL/TLS and ECC (Elliptic curve cryptography)

answered on Stack Overflow Feb 5, 2021 by Mateusz L

User contributions licensed under CC BY-SA 3.0