Android Question SSLProtocolException : Should I worry?

[Brian Dean]

I know next-to-nothing about net protocols so I am looking for guidance. An app that I released a few weeks ago (with 150 Playstore downloads) that am still developing has started throwing an "SSLProtocolException" error, but as far as I can see only on the devices that I use for debug. These devices are HTC Ones running Android 4.1.1. A less old device running Android 5.1.1 is unaffected; other newer devices are fine. The problem started a few evenings ago while I was doing some app development, so at first I assumed that I had caused the error - now I am not so sure. The app retrieves and scrapes html pages from a single web-site. My assumption is that something has changed in the path to the target url.

Here is the log message ..

javax.net.ssl.SSLHandshakeException: javax.net.ssl.SSLProtocolException: SSL handshake aborted: ssl=0x515e4ae0: Failure in SSL library, usually a protocol error

Should I worry? Is there anything that I can or should do? Can I leave things as they are (I have had no user complaints yet)?

The code is a perfectly normal HttpJob download, and I have tested it with other urls - no problems. Here is (I hope) the relevant section of the unfiltered log ...

*** Service (httputils2service) Create ***
** Service (httputils2service) Start **
pt_debug : pthread_create->start_routine=0x40b78645, tls=0x54a44f00, arg=0x50068b18
pt_debug : __thread_entry->func=0x40b78645
, tls=0x54a44f00, arg=0x50068b18
pt_debug : pthread_create->start_routine=0x40b78645, tls=0x54b48f00, arg=0x50aee960
pt_debug : __thread_entry->func=0x40b78645
, tls=0x54b48f00, arg=0x50aee960
VFY: unable to find class referenced in signature (Ljava/nio/file/Path;)
VFY: unable to find class referenced in signature ([Ljava/nio/file/OpenOption;)
VFY: unable to resolve static method 14132: Ljava/nio/file/Files;.newOutputStream (Ljava/nio/file/Path;[Ljava/nio/file/OpenOption;)Ljava/io/OutputStream;
VFY: unable to find class referenced in signature (Ljava/nio/file/Path;)
VFY: unable to find class referenced in signature ([Ljava/nio/file/OpenOption;)
VFY: unable to resolve static method 14131: Ljava/nio/file/Files;.newInputStream (Ljava/nio/file/Path;[Ljava/nio/file/OpenOption;)Ljava/io/InputStream;
javax.net.ssl.SSLHandshakeException: javax.net.ssl.SSLProtocolException: SSL handshake aborted: ssl=0x515e4ae0: Failure in SSL library, usually a protocol error
error:1407742E:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert protocol version (external/openssl/ssl/s23_clnt.c:741 0x4f457bbc:0x00000000)
    at org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:412)
    at okhttp3.internal.connection.RealConnection.connectTls(RealConnection.java:242)
    at okhttp3.internal.connection.RealConnection.establishProtocol(RealConnection.java:200)
    at okhttp3.internal.connection.RealConnection.buildConnection(RealConnection.java:174)
    at okhttp3.internal.connection.RealConnection.connect(RealConnection.java:114)
    at okhttp3.internal.connection.StreamAllocation.findConnection(StreamAllocation.java:196)
    at okhttp3.internal.connection.StreamAllocation.findHealthyConnection(StreamAllocation.java:132)
    at okhttp3.internal.connection.StreamAllocation.newStream(StreamAllocation.java:101)
    at okhttp3.internal.connection.ConnectInterceptor.intercept(ConnectInterceptor.java:42)
    at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:92)
    at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:67)
    at okhttp3.internal.cache.CacheInterceptor.intercept(CacheInterceptor.java:93)
    at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:92)
    at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:67)
    at okhttp3.internal.http.BridgeInterceptor.intercept(BridgeInterceptor.java:93)
    at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:92)
    at okhttp3.internal.http.RetryAndFollowUpInterceptor.intercept(RetryAndFollowUpInterceptor.java:120)
    at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:92)
    at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:67)
    at okhttp3.RealCall.getResponseWithInterceptorChain(RealCall.java:179)
    at okhttp3.RealCall.execute(RealCall.java:63)
    at anywheresoftware.b4h.okhttp.OkHttpClientWrapper.executeWithTimeout(OkHttpClientWrapper.java:156)
    at anywheresoftware.b4h.okhttp.OkHttpClientWrapper.access$0(OkHttpClientWrapper.java:153)
    at anywheresoftware.b4h.okhttp.OkHttpClientWrapper$ExecuteHelper.run(OkHttpClientWrapper.java:201)
    at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:442)
    at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:305)
    at java.util.concurrent.FutureTask.run(FutureTask.java:137)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1076)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:569)
    at java.lang.Thread.run(Thread.java:864)
    Suppressed: javax.net.ssl.SSLHandshakeException: javax.net.ssl.SSLProtocolException: SSL handshake aborted: ssl=0x515e4ae0: Failure in SSL library, usually a protocol error
error:1407742E:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert protocol version (external/openssl/ssl/s23_clnt.c:741 0x4f457bbc:0x00000000)
        ... 30 more
    Caused by: javax.net.ssl.SSLProtocolException: SSL handshake aborted: ssl=0x515e4ae0: Failure in SSL library, usually a protocol error
error:1407742E:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert protocol version (external/openssl/ssl/s23_clnt.c:741 0x4f457bbc:0x00000000)
        at org.apache.harmony.xnet.provider.jsse.NativeCrypto.SSL_do_handshake(Native Method)
        at org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:371)
        ... 29 more
Caused by: javax.net.ssl.SSLProtocolException: SSL handshake aborted: ssl=0x515e4ae0: Failure in SSL library, usually a protocol error
error:1407742E:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert protocol version (external/openssl/ssl/s23_clnt.c:741 0x4f457bbc:0x00000000)
    at org.apache.harmony.xnet.provider.jsse.NativeCrypto.SSL_do_handshake(Native Method)
    at org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:371)
    ... 29 more
ResponseError. Reason: javax.net.ssl.SSLHandshakeException: javax.net.ssl.SSLProtocolException: SSL handshake aborted: ssl=0x515e4ae0: Failure in SSL library, usually a protocol error
error:1407742E:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert protocol version (external/openssl/ssl/s23_clnt.c:741 0x4f457bbc:0x00000000), Response:
** Activity (main) Pause, UserClosed = false **

Thank you for any guidance or reassurance that you can offer.

 

[JohnC]

It may be that the website you were connecting to has finally "got with the program" and turned off support for TSL 1.0 - you can check the site for supported protocols here:

TLS Checker - Instant Results

Does your server or CDN support the latest TLS 1.3? Check your SSL/TLS setup now!

www.cdn77.com

And according to this post from Erel, Android 4.x devices do not support TLS 1.1+, which may be why your android 4.x can't connect to it anymore:

httpjob workes no more with https

since I've changed to targetSdkVersion 28 I have this error : ResponseError. Reason: javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not fou Sub Globals Dim j As HttpJob End Sub Sub Activity_Create(FirstTime As...

www.b4x.com

Also, there are very few android 4.x devices out there, so you wont loose a lot of customers of you only support 5.0+.

 

[Brian Dean]

@JohnC : Thanks.

Also, there are very few android 4.x devices out there, so you wont loose a lot of customers of you only support 5.0+.

I am sure that you are right. I use them mainly because they have smaller screens and more or less guarantee that, if a layout fits, then things will look fine on more up-to-date handsets.

 

[Erel]

Not sure that it worth the effort however you can update the security provider at runtime: https://www.b4x.com/android/forum/threads/ssl-websocket-client.88472/post-560032