supporting TLS v1.2 clients (eg android clients of API below 20) in openjdk version of conscrypt
- Dominant language
- Java
- Stars
- 1.4k
- Forks
- 326
- Avg merge
- 16h 22m
- Merged PRs (30d)
- 17
Description
Hello,
my client (and Android app running on Android 19 (this is a quite old version)), is getting error:
> 05-03 10:28:51.841 3827-3881/com.mythings.myapp1.develop D/OkHttp: <-- HTTP FAILED: java.io.IOException: unexpected end of stream on Connection{10.0.2.2:6578, proxy=DIRECT@ hostAddress=/10.0.2.2:6578 cipherSuite=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 protocol=http/1.1}
The problem goes away when I switch my Jetty server away from using Conscrypt, and back to using default Java 1.8 provider.
Is there is something that I could do to workaround this (The problem does not occur when I use android API 20+, because, I suspect, those support TLS 1.2 by default)
Thank you in advance
my server is jetty,
```
def jettyVersion = '9.4.15.v20190215'
def alpnBootVersion = '8.1.13.v20181017'
def alpnApiVersion = '1.1.3.v20160715'
def javalinVersion = '2.8.0'
def jacksonVersion = '2.9.8'
compile "org.eclipse.jetty.http2:http2-server:$jettyVersion"
compile "org.eclipse.jetty:jetty-alpn-conscrypt-server:$jettyVersion"
```
Conscrypt is used as provider:
```
private static org.eclipse.jetty.server.Server create_JettyHTTP2_SSHServer__Conscrypt(final int port, final int
maxNumOfThreads) {
QueuedThreadPool threadPool = new QueuedThreadPool(maxNumOfThreads > 250 ? maxNumOfThreads : 200,
8, 60__000);
org.eclipse.jetty.server.Server server = new org.eclipse.jetty.server.Server(threadPool);
server.addBean(new LowResourceMonitor(server));
// HTTP Configuration
org.eclipse.jetty.server.HttpConfiguration httpConfig = new org.eclipse.jetty.server.HttpConfiguration();
httpConfig.setSendServerVersion(false);
httpConfig.setSecureScheme("https");
httpConfig.setSecurePort(port);
org.eclipse.jetty.util.ssl.SslContextFactory sslContextFactory = new org.eclipse.jetty.util.ssl.SslContextFactory();
sslContextFactory.setKeyStorePath(
"path-to-my-certificate.jks"
); // replace with your real keystore
sslContextFactory.setKeyStorePassword("real password"); // replace with your real password
sslContextFactory.setCipherComparator(org.eclipse.jetty.http2.HTTP2Cipher.COMPARATOR);
sslContextFactory.setProvider("Conscrypt");
HttpConfiguration httpsConfig = new HttpConfiguration(httpConfig);
httpsConfig.addCustomizer(new SecureRequestCustomizer());
HTTP2ServerConnectionFactory h2 = new HTTP2ServerConnectionFactory(httpsConfig);
ALPNServerConnectionFactory alpn = new ALPNServerConnectionFactory();
alpn.setDefaultProtocol("h2");
SslConnectionFactory ssl = new SslConnectionFactory(sslContextFactory, alpn.getProtocol());
ServerConnector http2SshConnector = new ServerConnector(server, ssl, alpn, h2, new HttpConnectionFactory(httpsConfig));
http2SshConnector.setPort(port);
server.addConnector(http2SshConnector);
return server;
}
```
The android client specifically sets, to use TLSv1.2 using Google:
https://stackoverflow.com/questions/29916962/javax-net-ssl-sslhandshakeexception-javax-net-ssl-sslprotocolexception-ssl-han
```
try {
ProviderInstaller.installIfNeeded(getApplicationContext());
SSLContext sslContext;
sslContext = SSLContext.getInstance("TLSv1.2");
sslContext.init(null, null, null);
sslContext.createSSLEngine();
} catch (GooglePlayServicesRepairableException | GooglePlayServicesNotAvailableException
| NoSuchAlgorithmException | KeyManagementException e) {
e.printStackTrace();
}
```
Contributor guide
Assessment
This issue has not been assessed yet.