google / google/conscrypt

supporting TLS v1.2 clients (eg android clients of API below 20) in openjdk version of conscrypt

Open
#671 1 comment 0 reactions 0 assignees View on GitHub
needs investigation
Dominant language
Java
Stars
1.4k
Forks
326
Avg merge
16h 22m
Merged PRs (30d)
17

Description

Hello,
my client (and Android app running on Android 19 (this is a quite old version)), is getting error:

> 05-03 10:28:51.841 3827-3881/com.mythings.myapp1.develop D/OkHttp: <-- HTTP FAILED: java.io.IOException: unexpected end of stream on Connection{10.0.2.2:6578, proxy=DIRECT@ hostAddress=/10.0.2.2:6578 cipherSuite=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 protocol=http/1.1}

The problem goes away when I switch my Jetty server away from using Conscrypt, and back to using default Java 1.8 provider.

Is there is something that I could do to workaround this (The problem does not occur when I use android API 20+, because, I suspect, those support TLS 1.2 by default)

Thank you in advance

my server is jetty,

```
def jettyVersion = '9.4.15.v20190215'
def alpnBootVersion = '8.1.13.v20181017'
def alpnApiVersion = '1.1.3.v20160715'
def javalinVersion = '2.8.0'
def jacksonVersion = '2.9.8'
compile "org.eclipse.jetty.http2:http2-server:$jettyVersion"
compile "org.eclipse.jetty:jetty-alpn-conscrypt-server:$jettyVersion"

```

Conscrypt is used as provider:

```
private static org.eclipse.jetty.server.Server create_JettyHTTP2_SSHServer__Conscrypt(final int port, final int
maxNumOfThreads) {

QueuedThreadPool threadPool = new QueuedThreadPool(maxNumOfThreads > 250 ? maxNumOfThreads : 200,
8, 60__000);

org.eclipse.jetty.server.Server server = new org.eclipse.jetty.server.Server(threadPool);
server.addBean(new LowResourceMonitor(server));
// HTTP Configuration
org.eclipse.jetty.server.HttpConfiguration httpConfig = new org.eclipse.jetty.server.HttpConfiguration();
httpConfig.setSendServerVersion(false);
httpConfig.setSecureScheme("https");
httpConfig.setSecurePort(port);
org.eclipse.jetty.util.ssl.SslContextFactory sslContextFactory = new org.eclipse.jetty.util.ssl.SslContextFactory();
sslContextFactory.setKeyStorePath(
"path-to-my-certificate.jks"
); // replace with your real keystore
sslContextFactory.setKeyStorePassword("real password"); // replace with your real password
sslContextFactory.setCipherComparator(org.eclipse.jetty.http2.HTTP2Cipher.COMPARATOR);
sslContextFactory.setProvider("Conscrypt");
HttpConfiguration httpsConfig = new HttpConfiguration(httpConfig);
httpsConfig.addCustomizer(new SecureRequestCustomizer());
HTTP2ServerConnectionFactory h2 = new HTTP2ServerConnectionFactory(httpsConfig);
ALPNServerConnectionFactory alpn = new ALPNServerConnectionFactory();
alpn.setDefaultProtocol("h2");
SslConnectionFactory ssl = new SslConnectionFactory(sslContextFactory, alpn.getProtocol());
ServerConnector http2SshConnector = new ServerConnector(server, ssl, alpn, h2, new HttpConnectionFactory(httpsConfig));
http2SshConnector.setPort(port);
server.addConnector(http2SshConnector);
return server;
}

```

The android client specifically sets, to use TLSv1.2 using Google:

https://stackoverflow.com/questions/29916962/javax-net-ssl-sslhandshakeexception-javax-net-ssl-sslprotocolexception-ssl-han

```
try {
ProviderInstaller.installIfNeeded(getApplicationContext());
SSLContext sslContext;
sslContext = SSLContext.getInstance("TLSv1.2");
sslContext.init(null, null, null);
sslContext.createSSLEngine();
} catch (GooglePlayServicesRepairableException | GooglePlayServicesNotAvailableException
| NoSuchAlgorithmException | KeyManagementException e) {
e.printStackTrace();
}
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.