的Android在OKHttp

Question

启用TLSv1.2工作我用OKHttp我的项目。我想为我的服务呼叫启用TLSv1.2。任何机构都可以告诉我如何启用它。

Answer 1

据我所知OKHttp不包括自己的SSL/TLS库，因此它只是使用由Android提供的标准的SSLSocket。

什么都支持TLS版本（和启用）取决于所使用的Android版本。 在某些电话上支持TLS 1.2，但默认情况下未启用。在这种情况下，您可以通过实现自定义包装器SSLSocketFactory来启用它，该包装器在内部使用默认的SSLSocketFactory，并在创建的每个套接字上调用setEnabledProtocols(new String{"TLS1.2"})。

Answer 2

见OkHttp的HTTPS documentation。

ConnectionSpec spec = new ConnectionSpec.Builder(ConnectionSpec.MODERN_TLS) 
    .tlsVersions(TlsVersion.TLS_1_2) 
    .cipherSuites( 
    CipherSuite.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, 
    CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, 
    CipherSuite.TLS_DHE_RSA_WITH_AES_128_GCM_SHA256) 
    .build(); 
OkHttpClient client = ... 
client.setConnectionSpecs(Collections.singletonList(spec)); 

Answer 3

这是基本相同的答案above，但我觉得自己像一个代码示例将是谁比谁这里的土地和不加快速度航行的java的SSL景观有用。

什么最终结束了我的工作是基于此报告的问题：https://github.com/mattleibow/square-bindings/issues/1
从这个要点https://gist.github.com/mattleibow/c8abfa323db094b820cc

注意这些代码示例是用C＃/ Xamarin但也很容易被转换为Java。

internal class CompleteSSLSocketFactory : SSLSocketFactory 
{ 
    private readonly SSLSocketFactory innerFactory; 

    public CompleteSSLSocketFactory (SSLSocketFactory innerFactory) 
    { 
     this.innerFactory = innerFactory; 
    } 

    public override string[] GetDefaultCipherSuites() 
    { 
     return innerFactory.GetDefaultCipherSuites(); 
    } 

    public override string[] GetSupportedCipherSuites() 
    { 
     return innerFactory.GetSupportedCipherSuites(); 
    } 

    public override Socket CreateSocket() 
    { 
     return MakeSocketSafe (innerFactory.CreateSocket()); 
    } 

    public override Socket CreateSocket (Socket s, string host, int port, bool autoClose) 
    { 
     return MakeSocketSafe (innerFactory.CreateSocket (s, host, port, autoClose)); 
    } 

    public override Socket CreateSocket (string host, int port) 
    { 
     return MakeSocketSafe (innerFactory.CreateSocket (host, port)); 
    } 

    public override Socket CreateSocket (string host, int port, InetAddress localHost, int localPort) 
    { 
     return MakeSocketSafe (innerFactory.CreateSocket (host, port, localHost, localPort)); 
    } 

    public override Socket CreateSocket (InetAddress host, int port) 
    { 
     return MakeSocketSafe (innerFactory.CreateSocket (host, port)); 
    } 

    public override Socket CreateSocket (InetAddress address, int port, InetAddress localAddress, int localPort) 
    { 
     return MakeSocketSafe (innerFactory.CreateSocket (address, port, localAddress, localPort)); 
    } 

    private Socket MakeSocketSafe (Socket socket) 
    { 
     var sslSocket = socket as SSLSocket; 
     if (sslSocket != null) { 
      // enable all supported protocols for this socket 
      sslSocket.SetEnabledProtocols (sslSocket.GetSupportedProtocols()); 
      sslSocket.SetEnabledCipherSuites (sslSocket.GetSupportedCipherSuites()); 
     } 
     return socket; 
    } 
} 

，然后调用它像：

// this.client is an OkHttpClient 
if (Android.OS.Build.VERSION.SdkInt < BuildVersionCodes.Lollipop) { 
    this.client.SetSslSocketFactory(new CompleteSSLSocketFactory(HttpsURLConnection.DefaultSSLSocketFactory)); 
} 

这为我工作，在API测试19

Answer 4

原来我的解决方案是非常相似的Ken的（除Java之外）。我发现它here虽然不得不作出一些小的改变，使其工作。希望这个作品'开箱即用'为他人。

public class TLSSocketFactoryCompat extends SSLSocketFactory { 

private SSLSocketFactory internalSSLSocketFactory; 

public TLSSocketFactoryCompat() throws KeyManagementException, NoSuchAlgorithmException { 
    SSLContext context = SSLContext.getInstance("TLS"); 
    context.init(null, null, null); 
    internalSSLSocketFactory = context.getSocketFactory(); 
} 

public TLSSocketFactoryCompat(TrustManager[] tm) throws KeyManagementException, NoSuchAlgorithmException { 
    SSLContext context = SSLContext.getInstance("TLS"); 
    context.init(null, tm, new java.security.SecureRandom()); 
    internalSSLSocketFactory = context.getSocketFactory(); 
} 

@Override 
public String[] getDefaultCipherSuites() { 
    return internalSSLSocketFactory.getDefaultCipherSuites(); 
} 

@Override 
public String[] getSupportedCipherSuites() { 
    return internalSSLSocketFactory.getSupportedCipherSuites(); 
} 

@Override 
public Socket createSocket() throws IOException { 
    return enableTLSOnSocket(internalSSLSocketFactory.createSocket()); 
} 

@Override 
public Socket createSocket(Socket s, String host, int port, boolean autoClose) throws IOException { 
    return enableTLSOnSocket(internalSSLSocketFactory.createSocket(s, host, port, autoClose)); 
} 

@Override 
public Socket createSocket(String host, int port) throws IOException, UnknownHostException { 
    return enableTLSOnSocket(internalSSLSocketFactory.createSocket(host, port)); 
} 

@Override 
public Socket createSocket(String host, int port, InetAddress localHost, int localPort) throws IOException, UnknownHostException { 
    return enableTLSOnSocket(internalSSLSocketFactory.createSocket(host, port, localHost, localPort)); 
} 

@Override 
public Socket createSocket(InetAddress host, int port) throws IOException { 
    return enableTLSOnSocket(internalSSLSocketFactory.createSocket(host, port)); 
} 

@Override 
public Socket createSocket(InetAddress address, int port, InetAddress localAddress, int localPort) throws IOException { 
    return enableTLSOnSocket(internalSSLSocketFactory.createSocket(address, port, localAddress, localPort)); 
} 

private Socket enableTLSOnSocket(Socket socket) { 
    if(socket != null && (socket instanceof SSLSocket)) { 
     //Create list of supported protocols 
     ArrayList<String> supportedProtocols = new ArrayList<>(); 
     for (String protocol : ((SSLSocket)socket).getEnabledProtocols()) { 

      //Log.d("TLSSocketFactory", "Supported protocol:" + protocol); 
      //Only add TLS protocols (don't want ot support older SSL versions) 
      if (protocol.toUpperCase().contains("TLS")) { 
       supportedProtocols.add(protocol); 
      } 
     } 
     //Force add TLSv1.1 and 1.2 if not already added 
     if (!supportedProtocols.contains("TLSv1.1")) { 
      supportedProtocols.add("TLSv1.1"); 
     } 
     if (!supportedProtocols.contains("TLSv1.2")) { 
      supportedProtocols.add("TLSv1.2"); 
     } 

     String[] protocolArray = supportedProtocols.toArray(new String[supportedProtocols.size()]); 
     /*for (int i = 0; i < protocolArray.length; i++) { 
      Log.d("TLSSocketFactory", "protocolArray[" + i + "]" + protocolArray[i]); 
     }*/ 

     //enable protocols in our list 
     ((SSLSocket)socket).setEnabledProtocols(protocolArray); 
    } 
    return socket; 
} 

}

用法：

OkHttpClient httpClient = new OkHttpClient(); 
    //Add Custom SSL Socket Factory which adds TLS 1.1 and 1.2 support for Android 4.1-4.4 
    try { 
     httpClient.setSslSocketFactory(new TLSSocketFactoryCompat()); 
    } catch (KeyManagementException e) { 
     e.printStackTrace(); 
    } catch (NoSuchAlgorithmException e) { 
     e.printStackTrace(); 
    } 

Answer 5

检查我的代码！工作完美！

private void checkTls() { 
    if (android.os.Build.VERSION.SDK_INT < 21) { 
     try { 
      ProviderInstaller.installIfNeededAsync(this, new ProviderInstaller.ProviderInstallListener() { 
       @Override 
       public void onProviderInstalled() { 
       } 

       @Override 
       public void onProviderInstallFailed(int i, Intent intent) { 
       } 
      }); 
     } catch (Exception e) { 
      finish(); 
      e.printStackTrace(); 
     } 
    } 
}