android - 是否可以在 Android N 上使用仅支持 TLS 1.0 的证书后端？

Question

我有一个 targetSdkVersion 23 的应用程序，但在 Android N(apiLevel 24)上启动时，所有与后端的连接都会引发异常:

javax.net.ssl.SSLHandshakeException: Handshake failed
at com.android.org.conscrypt.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:429)
at com.android.okhttp.Connection.connectTls(Connection.java:235)
at com.android.okhttp.Connection.connectSocket(Connection.java:199)
at com.android.okhttp.Connection.connect(Connection.java:172)
at com.android.okhttp.Connection.connectAndSetOwner(Connection.java:367)
at com.android.okhttp.OkHttpClient$1.connectAndSetOwner(OkHttpClient.java:130)
at com.android.okhttp.internal.http.HttpEngine.connect(HttpEngine.java:329)
at com.android.okhttp.internal.http.HttpEngine.sendRequest(HttpEngine.java:246)
at com.android.okhttp.internal.huc.HttpURLConnectionImpl.execute(HttpURLConnectionImpl.java:457)
at com.android.okhttp.internal.huc.HttpURLConnectionImpl.connect(HttpURLConnectionImpl.java:126)
at com.android.okhttp.internal.huc.DelegatingHttpsURLConnection.connect(DelegatingHttpsURLConnection.java:89)
at com.android.okhttp.internal.huc.HttpsURLConnectionImpl.connect(HttpsURLConnectionImpl.java)`
<...>
Suppressed: javax.net.ssl.SSLHandshakeException: Handshake failed
    ... 23 more
Suppressed: javax.net.ssl.SSLHandshakeException: Handshake failed
    ... 23 more
Caused by: javax.net.ssl.SSLProtocolException: SSL handshake aborted: ssl=0x7ffeec27f540: Failure in SSL library, usually a protocol error
error:100000f3:SSL routines:OPENSSL_internal:WRONG_CURVE (external/boringssl/src/ssl/s3_clnt.c:1205 0x7ffee9cef70a:0x00000000)
at com.android.org.conscrypt.NativeCrypto.SSL_do_handshake(Native Method)
at com.android.org.conscrypt.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:357)
    ... 22 more
Caused by: javax.net.ssl.SSLProtocolException: SSL handshake aborted: ssl=0x7ffeec27f540: Failure in SSL library, usually a protocol error
error:100000f3:SSL routines:OPENSSL_internal:WRONG_CURVE (external/boringssl/src/ssl/s3_clnt.c:1205 0x7ffee9cef70a:0x00000000)
at com.android.org.conscrypt.NativeCrypto.SSL_do_handshake(Native Method)
at com.android.org.conscrypt.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:357)
    ... 22 more
Caused by: javax.net.ssl.SSLProtocolException: SSL handshake aborted: ssl=0x7ffeec27f540: Failure in SSL library, usually a protocol error
error:100000f3:SSL routines:OPENSSL_internal:WRONG_CURVE (external/boringssl/src/ssl/s3_clnt.c:1205 0x7ffee9cef70a:0x00000000)
at com.android.org.conscrypt.NativeCrypto.SSL_do_handshake(Native Method)
at com.android.org.conscrypt.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:357)
    ... 22 more

我的后端证书只支持 TLSv1 协议(protocol)。这是 Android N 的问题吗？

已编辑 1:将 targetSdkVersion 更改为 24 会得到相同的结果。

编辑 2:我们的目标网址是 https://med.firecracker.me/

Answer 1

最后，证书已更新为支持 TLS 1.2。