Intermittent SSLHandshakeException calling a GET with OKHttp

user_987753 0
Viewed 525

EDIT

It does not seem to be a duplicate to me since all the other questions are related with repeatable issues and not intermittent like this one

END-EDIT

I have an app that runs some HTTP GET. The app runs on API 21+. It works fine most of the time, but very rarely one HTTP GET fails with the error:

D/OkHttp: --> GET https://url/url2?parm1=value1
D/OkHttp: --> END GET
D/OkHttp: <-- HTTP FAILED: javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.

When this starts happening, it keeps happening until I kill the app. I'm using Retrofit with OKHttp 4.3.1. I'm going to update to the latest version now just in case this is a bug in OKHttp but I didn't find any report.

The code for the HTTP call is the usual code with Retrofit:

private val retrofit: Retrofit
    get() = Retrofit.Builder()
            .baseUrl(BuildConfig.BASE_URL)
            .addConverterFactory(GsonConverterFactory.create(gson))
            .addCallAdapterFactory(CoroutineCallAdapterFactory())
            .client(client)
            .build()

internal val service: AppService
    get() = retrofit.create<AppService>(AppService::class.java)

internal interface AppService {
    @GET
    suspend fun loadServerListAsync(@Url url: String): Response<List<Server>>
}

In the past I have seen this error in another app. In that case the error wasn't intermittent and the problem was on the backend: they had changed a certificate, but they hadn't updated all the intermediate certificates.

In this case it looks like the error is different since it is intermittent and killing the app fixes it. There is no load balancer on the backend so it can't be that different servers have different certificates.

okhttp ssl android
1 Answers

It can be related from cypher security protocol TLSv1 to fail and fallback to deprecated SSLv3.

To prevent TLSv1 secure connection to fallback to SSLv3 in simulator and throw connection error because SSLv3 is now deprecated and unsecure (Android Studio Failure in SSL library, usually a protocol error)

Install updated security provider using Google Play Services. This effectively gives your app access to a newer version of OpenSSL and Java Security Provider, which includes support for TLSv1.2 in SSLEngine. Once the new provider is installed, you can create an SSLEngine which supports SSLv3, TLSv1, TLSv1.1 and TLSv1.2 the usual way.

This should be the answer to your problem : Javax.net.ssl.SSLHandshakeException: javax.net.ssl.SSLProtocolException: SSL handshake aborted: Failure in SSL library, usually a protocol error

user_3994390
Related