comment puis-je ajouter le support pour CipherSuits de TLSv1.2 spécifiques avec OkHttp - Android 4.4 KitKat (api 19)

Question

Mon api soutient qu'à la suite CipherSuits (trouvé cela avec l'aide de ssllab)

TLSv1.2 
    TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 - OkHttp: yes 
    TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 - OkHttp: yes 
    TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 - OkHttp: yes 
    TLS_DHE_RAS_WITH_AES_128_GCM_SHA256 - OkHttp: no 

tous ces éléments sont pris en charge sur Android api 20+ vu sur SSLSocket

J'ai essayé adding support for TLSv1.2 à OkHttp mais je reçois toujours l'erreur habituelle

HTTP FAILED: javax.net.ssl.SSLHandshakeException: com.android.org.bouncycastle.jce.exception.ExtCertPathValidatorException: Could not validate certificate: null

alors j'ajouté les CipherSuits à ConnectionSpec et a échoué

ConnectionSpec cs = new ConnectionSpec.Builder(ConnectionSpec.MODERN_TLS) 
        .tlsVersions(TlsVersion.TLS_1_2) 
        .cipherSuites(
          TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, 
          TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, 
          TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 
        ) 
        .build(); 

HTTP FAILED: java.net.UnknownServiceException: Unable to find acceptable protocols. isFallback=false, modes=[ConnectionSpec(cipherSuites=[TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384], tlsVersions=[TLS_1_2], supportsTlsExtensions=true)], supported protocols=[TLSv1.2]

Connection fonctionne très bien sur Android api 21 ans et plus.

Alors est-il possible d'ajouter le support pour ces CipherSuits?

Answer 1

ajouter à votre client okhttp

public class TLSSocketFactory extends SSLSocketFactory { 

private SSLSocketFactory delegate; 

public TLSSocketFactory() throws KeyManagementException, NoSuchAlgorithmException { 
    SSLContext context = SSLContext.getInstance("TLS"); 
    context.init(null, null, null); 
    delegate = context.getSocketFactory(); 
} 

@Override 
public String[] getDefaultCipherSuites() { 
    return delegate.getDefaultCipherSuites(); 
} 

@Override 
public String[] getSupportedCipherSuites() { 
    return delegate.getSupportedCipherSuites(); 
} 

@Override 
public Socket createSocket() throws IOException { 
    return enableTLSOnSocket(delegate.createSocket()); 
} 

@Override 
public Socket createSocket(Socket s, String host, int port, boolean autoClose) throws IOException { 
    return enableTLSOnSocket(delegate.createSocket(s, host, port, autoClose)); 
} 

@Override 
public Socket createSocket(String host, int port) throws IOException, UnknownHostException { 
    return enableTLSOnSocket(delegate.createSocket(host, port)); 
} 

@Override 
public Socket createSocket(String host, int port, InetAddress localHost, int localPort) throws IOException, UnknownHostException { 
    return enableTLSOnSocket(delegate.createSocket(host, port, localHost, localPort)); 
} 

@Override 
public Socket createSocket(InetAddress host, int port) throws IOException { 
    return enableTLSOnSocket(delegate.createSocket(host, port)); 
} 

@Override 
public Socket createSocket(InetAddress address, int port, InetAddress localAddress, int localPort) throws IOException { 
    return enableTLSOnSocket(delegate.createSocket(address, port, localAddress, localPort)); 
} 

private Socket enableTLSOnSocket(Socket socket) { 
    if(socket != null && (socket instanceof SSLSocket)) { 
     ((SSLSocket)socket).setEnabledProtocols(new String[] {"TLSv1.1", "TLSv1.2"}); 
    } 
    return socket; 
} 

} 

comme celui-ci

OkHttpClient client=new OkHttpClient(); 
try { 
    client = new OkHttpClient.Builder() 
      .sslSocketFactory(new TLSSocketFactory()) 
      .build(); 
} catch (KeyManagementException e) { 
    e.printStackTrace(); 
} catch (NoSuchAlgorithmException e) { 
    e.printStackTrace(); 
}