Android 4.1 至 4.4 KitKat - 为 API 启用 TLS 1.2

Question

在尝试禁用TLS 1.0时，有KitKat设备需要访问我的API。我尝试覆盖默认套接字工厂但没有成功。我试过转换为okhttp。仍然不工作。如何讓 Android KitKat 連接到我的 API？

Answer 1

我在棒棒糖之前的设备上遇到了同样的问题。当我使用Retrofit时，这是OkHttp的解决方案。

Tls12SocketFactory.java：

public class Tls12SocketFactory extends SSLSocketFactory {
private static final String[] TLS_V12_ONLY = {"TLSv1.2"};
final SSLSocketFactory delegate;
public Tls12SocketFactory(SSLSocketFactory base) {
this.delegate = base;
}
@Override
public String[] getDefaultCipherSuites() {
return delegate.getDefaultCipherSuites();
}
@Override
public String[] getSupportedCipherSuites() {
return delegate.getSupportedCipherSuites();
}
@Override
public Socket createSocket(Socket s, String host, int port, boolean autoClose) throws IOException {
return patch(delegate.createSocket(s, host, port, autoClose));
}
@Override
public Socket createSocket(String host, int port) throws IOException, UnknownHostException {
return patch(delegate.createSocket(host, port));
}
@Override
public Socket createSocket(String host, int port, InetAddress localHost, int localPort) throws IOException, UnknownHostException {
return patch(delegate.createSocket(host, port, localHost, localPort));
}
@Override
public Socket createSocket(InetAddress host, int port) throws IOException {
return patch(delegate.createSocket(host, port));
}
@Override
public Socket createSocket(InetAddress address, int port, InetAddress localAddress, int localPort) throws IOException {
return patch(delegate.createSocket(address, port, localAddress, localPort));
}
private Socket patch(Socket s) {
if (s instanceof SSLSocket) {
((SSLSocket) s).setEnabledProtocols(TLS_V12_ONLY);
}
return s;
}
}

OkHttpUtils.java：

public class OkHttpUtills {
public static OkHttpClient createHttpClient() {
HttpLoggingInterceptor logging = new HttpLoggingInterceptor();
logging.setLevel(HttpLoggingInterceptor.Level.BODY);
OkHttpClient.Builder client = new OkHttpClient.Builder()
.followRedirects(true)
.followSslRedirects(true)
.addInterceptor(logging)
.cache(null)
.connectTimeout(15, TimeUnit.SECONDS)
.writeTimeout(15, TimeUnit.SECONDS)
.readTimeout(15, TimeUnit.SECONDS);
return enableTls12OnPreLollipop(client).build();
}

/**
* Enables TLSv1.2 protocol (which is disabled by default)
* on pre-Lollipop devices, as well as on Lollipop, because some issues can take place on Samsung devices.
*
* @param client OKHtp client builder
* @return
*/
private static OkHttpClient.Builder enableTls12OnPreLollipop(OkHttpClient.Builder client) {
if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.JELLY_BEAN && Build.VERSION.SDK_INT < Build.VERSION_CODES.LOLLIPOP_MR1) {
try {
SSLContext sc = SSLContext.getInstance("TLSv1.2");
sc.init(null, null, null);
client.sslSocketFactory(new Tls12SocketFactory(sc.getSocketFactory()));
ConnectionSpec cs = new ConnectionSpec.Builder(ConnectionSpec.MODERN_TLS)
.tlsVersions(TlsVersion.TLS_1_2)
.build();
List<ConnectionSpec> specs = new ArrayList<>();
specs.add(cs);
specs.add(ConnectionSpec.COMPATIBLE_TLS);
specs.add(ConnectionSpec.CLEARTEXT);
client.connectionSpecs(specs);
} catch (Exception exc) {
Log.e("OkHttpTLSCompat", "Error while setting TLS 1.2", exc);
}
}
return client;
}
}

希望这能帮助你。

Answer 2

OkHttp 3.12.x 将自动执行此操作，请参阅 https://github.com/square/okhttp/blob/okhttp_3.12.x/okhttp/src/main/java/okhttp3/internal/platform/AndroidPlatform.java#L452

Answer 3

此外，我需要为4.4.3安卓手机实现TLS 1.2(Java安全提供程序(。

如果您可以访问Google Play服务，则可以通过以下方式获取

ProviderInstaller.installIfNeeded(getContext());

您需要在build.gradle中包含 GM

compile 'com.google.android.gms:play-services:6.+'

这在评论中已经提到，并在此处描述

---

否则，如果您无法使用Google Play服务，则可以使用conscrypt

Provider conscrypt = Conscrypt.newProvider();
// Add as provider
Security.insertProviderAt(conscrypt, 1);
X509TrustManager tm = new
X509TrustManager() {
public void checkClientTrusted(X509Certificate[] chain,
String authType) throws
CertificateException {
}
public void checkServerTrusted(X509Certificate[] chain,
String authType) throws
CertificateException {
}
public X509Certificate[] getAcceptedIssuers() {
return new X509Certificate[0];
}
};
SSLContext sslContext = SSLContext.getInstance("TLS", conscrypt);
sslContext.init(null, new TrustManager[]{tm}, null);
SSLContext.setDefault(sslContext);
HttpsURLConnection.setDefaultSSLSocketFactory(
sslContext.getSocketFactory());

此外，您需要一个支持 TLS 1.2 的TlsSocketFactory实现，如前所述。我从github中的一个要点中找到了这种方法。向卡雷万致敬