android - Oreo 上的 SSL 握手失败

Question

我正在尝试使用自签名证书与服务器交互。

它对牛轧糖很好用，但对奥利奥有异常(exception):

javax.net.ssl.SSLHandshakeException: Handshake failed
    at com.android.org.conscrypt.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:444)

基于 Android O 的 changelog ，在不安全的协议(protocol)回退方面似乎确实发生了变化。我只想确保我的信任经理不是问题所在:

public static OkHttpClient getClient() {
    try {
        // Create a trust manager that does not validate certificate chains
        final TrustManager[] trustAllCerts = new TrustManager[]{
                new X509TrustManager() {
                    @SuppressLint("TrustAllX509TrustManager")
                    @Override
                    public void checkClientTrusted(java.security.cert.X509Certificate[] chain, String authType) throws CertificateException {
                    }

                    @SuppressLint("TrustAllX509TrustManager")
                    @Override
                    public void checkServerTrusted(java.security.cert.X509Certificate[] chain, String authType) throws CertificateException {
                    }

                    @Override
                    public java.security.cert.X509Certificate[] getAcceptedIssuers() {
                        return new java.security.cert.X509Certificate[]{};
                    }
                }
        };

        // Install the all-trusting trust manager
        final SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(null, trustAllCerts, new java.security.SecureRandom());

        // Create an ssl socket factory with our all-trusting manager
        final SSLSocketFactory sslSocketFactory = sslContext.getSocketFactory();

        OkHttpClient.Builder builder = new OkHttpClient.Builder();
        builder.sslSocketFactory(sslSocketFactory, (X509TrustManager) trustAllCerts[0]);

        // Allow our hostname
        builder.hostnameVerifier((hostname, session) -> {
            return hostname.equals(API_HOST_NAME);
        });
        builder.addInterceptor(new MyCustomInterceptor());
        if (BuildConfig.DEBUG) {
            builder.addInterceptor(new HttpLoggingInterceptor().setLevel(HttpLoggingInterceptor.Level.BASIC));
            builder.addNetworkInterceptor(new StethoInterceptor());
        }
        return builder.build();
    } catch (Exception e) {
        throw new RuntimeException(e);
    }
}

服务器的配置基于 this example .

我的客户端是否有任何明显的错误，或者这可能是服务器上的问题？

Answer 1

经过更多测试，它似乎可以在 Oreo 上运行，并且是 Android 7.0 的问题

我们问题的解决方案在 this 中找到堆栈溢出，引用 this Android 错误。

总而言之，该问题与仅支持一条椭圆曲线的 Android 7.0 有关。