Android Question SSL connection failures

Lee Gillie CCP

Active Member
Licensed User
Longtime User
I have been running our last deployment without issue since Feb 2019. There are perhaps around 12 tablets, with our B4A app installed on:
  • P00I - Asus
  • VK700 - LGE
  • SM-T597V - Samsung
Yesterday they all worked fine. Today, at first only the LGE failed, and it was all LGE tablets out there which failed. About an hour ago all tablets now fail to connect. My first thought was perhaps a new Android was just pushed. Or some other major news event because I have been out of the loop for a bit. I have an LGE at the office, but I am working remotely at present, so I can not get to the office. I cant reproduce and check the Android's log from there at the moment. These tablets all connect via Verizon. The server they attempt to connect to is a custom .NET service which provides web services API.

This one has me baffled, but maybe someone else started having similar issues today or very recently?

I know it is not much to go on, so grasping at straws here. I sure hope someone has an idea or two.

Best regards - Lee Gillie, CCP - Spokane, WA
 
Last edited:
Sort by date Sort by votes

JohnC

Expert
Licensed User
Longtime User
I just had an SSL problem with my email client not being able to make a secure connection to my private VPS server.

It turns out that even though my VPS's SSL certificate wasn't going to expire until 7/1/20, it was the "root" certificate for that SSL which was one of the built-in certificates in my android device that expired on 5/30/20 (Android phones come with a bunch of built-in root certificates that are used to validate various SSL certificates on the internet).

So the solution was to just renew the SSL certificate of my VPS server using a different company so it would cause my android device to use a different root certificate to certify it, and everything started working again.

This may have nothing to do with your issue, but then again, it might also save you the time I had to spend troubleshoot my issue.
 
Upvote 0

MicroDrie

Well-Known Member
Licensed User
Longtime User
JohnC said:
So the solution was to just renew the SSL certificate of my VPS server using a different company so it would cause my android device to use a different root certificate to certify it, and everything started working again.
Click to expand...

Saidly ?, your are not the first with the problem of a expired SSL certificate. Fortunately ?, a solution has been found for that challenge. And you can of course expect from an economical ? (also called miserly ?) Dutchman that it is of course also free of charge ?. Is now used on more than 200 million websites ??.

 
Upvote 0

Lee Gillie

New Member
Licensed User
Longtime User
Curiously some of the tablets have started being able to negotiate SSL all on their own, apparently. So now about half of them are making it through. They are able to web browse without issue. I wonder if Android has a certificate cache, and maybe there exists a way to clear it. This is so bizarre!
 
Upvote 0

Lee Gillie CCP

Active Member
Licensed User
Longtime User
More info. All tablet models EXCEPT the LG are connecting as of now. They are on Android version 5.0.2. I heard TLS 1.0/1.1 deprecated on 6/1/2020 for some software. I don't really know how this works, but could it be that a certificate in a cache was negotiated with TLS 1.1. Those running now have renegotiated under TLS 1.2. I am struggling to understand this where most if not all went away, and little by little they are coming back, and only those of a certain model remain unable to connect.
 
Upvote 0

Lee Gillie CCP

Active Member
Licensed User
Longtime User
More info...

I am working remotely, but I FINALLY got a co-worker to access LOGCAT and found this...


and also


I suspect Google deployed something, or perhaps something at Google APIs changed on June 1, 2020. I suspect ANYWHERE runtimes we installed with our app are no longer compatible for some reason. (at least on these antique LG tablets) Our app was last compiled, built and deployed from B4A version 8.90.

I am hopeful that if we update to B4A 9.80, and do what ever SDK updates are mandatory for it, and also make any code changes needed to jump from 8.90 to 9.80 that it will likely fix the incompatibility, and restore life to our 2014 LG tablets. I note that 2016 Asus tablets, and 2018 Samsung tablets have zero problems. It is ONLY the LG tablets that are no longer able to negotiation SSL, and begin communications to our proprietary web services API.

Any hints for things to watch for along the upgrade path would be EXTREMELY appreciated as we start down this path tomorrow.

Best regards - Lee
 
Last edited:
Upvote 0

MicroDrie

Well-Known Member
Licensed User
Longtime User
Perhaps this article How To Fix SSL Connection Error On Android? can give you ideas for a quick fix? Specially the Clear Browsing History & Caches could be interesting to get ride of old certificates which are not be used anymore.
 
Upvote 0

Lee Gillie CCP

Active Member
Licensed User
Longtime User
We are really getting nowhere quickly with this.

On the .NET web api data service, we manage the connections. We tried allowing ANY negotiated handshake (we prefer TLS 1.2 minimum, but we opened it up to allow anything for this test, for which .NET will use the highest level it can). Further, we always fully validate (and log) all the certificate chain elements, and all elements are valid, and have not expired.

On the server side we see the incoming socket connection, but SSL authentication fails with an error that suggests the client disconnected prematurely, and our initial attempt to read the stream behaves as if the stream is empty. The stream length is reported as -1.

As per Erel, We converted our code to use OkHttpUtils2 and are using the very latest version of it, and still the LG tablets are not able to connect via SSL. All more recent tablet models we presume continue to work as they did before, as they should and are able to use SSL.

As per MicroDrie we followed the link. We found there was a new update for google web browser, so we installed it, and tried again. This also made no difference.

As of the moment our only working implementation is to provide a second non-secure port for our web API data service. I am not really proud of the only option to offer the customer is to eliminate security, or to replace all of those 2014 LG tablets with newer ones.

At failure logcat reports: javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.

Earlier in logcat, I presume as tablet started, we see this, which I have no idea if it is relevant:
 
Last edited:
Upvote 0

OliverA

Expert
Licensed User
Longtime User
Have you tried updating Google Play services on the device? Here's @Erel's posting: https://www.b4x.com/android/forum/threads/ssl-websocket-client.88472/post-560044
I use @Erel's provided code in Main as following sub:
B4X: 
Sub CheckProviderInstaller As ResumableSub
    ' Don't forget to add to module:
'#AdditionalJar: com.google.android.gms:play-services-base
    'Don't forget to add to the Manifest
'    '************ Google Play Services Base ************
'    AddApplicationText(
'    <Activity android:name="com.google.android.gms.common.api.GoogleApiActivity"
'    android:theme="@android:style/Theme.Translucent.NoTitleBar"
'    android:exported="false"/>
'    <meta-data
'    android:name="com.google.android.gms.version"
'    android:value="@integer/google_play_services_version" />
'    )
'    '************ Google Play Services Base (end) ************
    Dim retVal As Boolean = False
    Dim jo As JavaObject
    jo.InitializeStatic("com.google.android.gms.security.ProviderInstaller")
    Dim context As JavaObject
    context.InitializeContext
    Dim listener As Object = jo.CreateEventFromUI("com.google.android.gms.security.ProviderInstaller.ProviderInstallListener", _
        "listener", Null)
    Log("Installing security provider if needed...")
    jo.RunMethod("installIfNeededAsync", Array(context, listener))
    Wait For listener_Event (MethodName As String, Args() As Object)
    If MethodName = "onProviderInstalled" Then
        Log("Provider installed successfully")
        retVal = True
    Else
        Log("Error installing provider: " & Args(0))
    End If
    Return retVal
End Sub

I call this code in Activity Resume like this:
B4X: 
Wait For (CheckProviderInstaller) complete (success As Boolean)
 
Upvote 0

Lee Gillie CCP

Active Member
Licensed User
Longtime User
OliverA said:
Have you tried updating Google Play services on the device? Here's @Erel's posting: https://www.b4x.com/android/forum/threads/ssl-websocket-
Click to expand...

You raise an excellent point.

I wonder how it may affect us though. I know to get your APK into Google Play for deployment, it filters out apps supporting the known weak TLS 1.1. But we have chosen to solely side-load our application to fleet tablets we are supporting. I know these problematic LG tablets are circa 2014, and may have a limit on the Android API SDK version that can be installed to them (because every model seems to have an eventual limit on Android version they will receive). I have requested staff to survey the 3 tablet models in the field for Android version they are running, and see if we can possibly up the target SDK on our project. I suspect older SDK API versions might not support the minimal TLS 1.2.

But another thing I noticed in the LOGCAT just PRIOR to SSL negotiation failure is that it appears there may be some communication with google services. This is NOT part of the standard SSL negotiation, as I would expect only primary, root, and intermediate CAs to be involved in the negotiation. But perhaps with Android, it is phoning home to the mother ship (google) and THAT may now be limiting us on TLS level that can be used.

I don't know for certain yet, because I don't know Android levels in the field, and I don't know what the API SDK's support for TLS level, but it may simply mean that this hardware is officially obsolete. I truly would hate to go to the customer and tell them they must replace half of their deployed tablets, without more certainty.

Thank you OliverA for taking time to consider this.

Best regards - Lee
 
Upvote 0

OliverA

Expert
Licensed User
Longtime User
Lee Gillie CCP said:
But we have chosen to solely side-load our application to fleet tablets we are supporting
Click to expand...
I use the above posted code on a pure side loaded application. The code just updates Android's security provider. The error message you posted after updating to OkHttpUtils2 seem to indicate that the security provider is out of date. I'm pretty sure the code will fail on API levels below 21 (Android 5).

Note: A quick "googling" on the LG tablet seem to indicate it came with KitKat (4.4) out of the factory, but an update to Lollipop (5) was made available. If the tablets are still on KitKat, they will definitely fail. The solution then would be to update them to Lollipop.
 
Last edited:
Upvote 0

Lee Gillie CCP

Active Member
Licensed User
Longtime User
I have confirmed the LG tablets have 5.0.2 Android installed. All other tablets (the ones that work with SSL) are running either 7 or 9.

I see your installer working...


This is an asynchronous activity, so the results of it are logged a bit later...

I/B4A (12092): ~l6168681753:Provider installed successfully
Click to expand...

But it continues to fail to do the SSL authentication, with the same exception as before...


So, once again I find myself at wit's end. Please help!
 
Upvote 0

OliverA

Expert
Licensed User
Longtime User
Upvote 0

Lee Gillie CCP

Active Member
Licensed User
Longtime User
Actually, we explored this the other day...



Also when our server fires up it immediately builds and validates all elements of the chain, and all of that looks as it should.
 
Upvote 0

OliverA

Expert
Licensed User
Longtime User
Are you sure the server is allowing TLS 1.2? Maybe someone reconfigured the server and disabled TLS 1.2. On the above linked site, check the "Check for common vulnerabilities" box and see if your server still supports TLS 1.2
 
Upvote 0

Lee Gillie CCP

Active Member
Licensed User
Longtime User
OliverA said:
Are you sure the server is allowing TLS 1.2? Maybe someone reconfigured the server and disabled TLS 1.2. On the above linked site, check the "Check for common vulnerabilities" box and see if your server still supports TLS 1.2
Click to expand...

I originally had it PREVENT TLS 1.1. But when we started having this problem we, via (.NET) AuthenticateAsServer with the option to negotiate the highest possible TLS between client and server, with no LOWER limits on what we will accept. We see TLS 1.2 (and 1.3 as I recall) negotiated for those newer (2019) circa tablets. Again only these old LG tablets (2014) running Android 5.0.2 fail SSL.
 
Upvote 0

OliverA

Expert
Licensed User
Longtime User
Upvote 0

OliverA

Expert
Licensed User
Longtime User
Do you have one of the tablets at hand? You could try creating a "toilet" here https://ptsv2.com/ and see if you can connect to it via the offending table. Or any other https enabled site. This way you could test if all https traffic is doomed to failure or only your site.
 
Upvote 0

MicroDrie

Well-Known Member
Licensed User
Longtime User
Because LGe is the only one which refused your solution and looking to fact that the LGE was released around the time of the TLS 1.2 required introduction, this all rise the question has LGE ever made a TLS update?

This article Protect Your Android App Against SSL Exploits said:

Perhaps you can give the suggestion to update to the leatist the last SSL version:
 
Upvote 0
You must log in or register to reply here.
Menu
Log in
Register
Cookies are required to use this site. You must accept them to continue using the site. Learn more…