android - 由于 Android Lollipop 5.0 我无法通过 SSL 或 TLSv1 与服务器 (X509TrustManager) 通信

Question

我希望有人能在这里帮助我。从 Android Lollipop 5.0 开始，我无法通过 SSL 与服务器 (X509TrustManager) 通信。该应用程序似乎正在进入一个试图建立握手的无限循环。这是我的代码:

    SSLContext sc;
SSLSocket sslsock;
Socket sock;

// Constructor
RfbProto(String h, int p) throws IOException{
        host = h;
        port = p;

        TrustManager[] trustAllCerts = new TrustManager[] {
                new X509TrustManager() {  
                    public java.security.cert.X509Certificate[] getAcceptedIssuers() {  
                        return null;  
                    }  
                    public void checkClientTrusted(X509Certificate[] certs, String authType){}
                    public void checkServerTrusted(X509Certificate[] certs, String authType){}
                }
        };  

        try {
            sc = SSLContext.getInstance("SSL");  
            sc.init(null, trustAllCerts, new java.security.SecureRandom());  
        } catch (Exception e) { }

        sock = new Socket();
        sock.connect(new InetSocketAddress(host, port), 5000);
        sock.setSoTimeout(10000);

        SSLSocketFactory factory = (SSLSocketFactory)sc.getSocketFactory();
        sslsock = (SSLSocket)factory.createSocket(sock, null, 0, false);

        is = new DataInputStream(new BufferedInputStream(sock.getInputStream(), 16384));
        os = sock.getOutputStream();    

        timing = false;
        timeWaitedIn100us = 5;
        timedKbits = 0;
    }

    public void enableSSL() throws IOException{

        this.sslEnabled = true;

        final SSLSocket fSock = sslsock;
        sslsock.addHandshakeCompletedListener(new HandshakeCompletedListener() {            
            @Override
            public void handshakeCompleted(HandshakeCompletedEvent event) {
                try {
                    Certificate[] peerCertificates = event.getPeerCertificates();
                    if (peerCertificates.length > 0) {
                        serverCertificate = (X509Certificate)peerCertificates[0];
                    }       
                    is = new DataInputStream(new BufferedInputStream(fSock.getInputStream(), 16384));
                    os = fSock.getOutputStream();

                } catch (SSLPeerUnverifiedException e) {
                    e.printStackTrace();
                } catch (IOException e) {
                    e.printStackTrace();
                }
            }
        });
        try {
            fSock.startHandshake();
        } catch (IOException e) {
            e.printStackTrace();
        }
    }

查看 Android 5.0 changes ，TLS/SSL 默认配置有一些变化，但我不确定从哪里开始。任何帮助将不胜感激

Answer 1

尝试强制 TLSv1 握手。自去年年底以来，SSL 被认为是易受攻击的 (POODLE)，并且在许多服务器应用程序中被禁用(例如，所有支付组织，如 Visa/MasterCard)。