-
-
Save hoajb/eab6ce1783ff397630fccb2a38fb3249 to your computer and use it in GitHub Desktop.
Enable TLS 1.2 in Android 4.4
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
1. To enable TLS 1.2 in Android 4.4 | |
Copy TLSSocketFactory.java | |
If using HttpsURLConnection: | |
=> conn.setSSLSocketFactory(new TLSSocketFactory()); | |
Else if using OkHttp: | |
=> new OkHttpClient.Builder().setSocketFactory(new TLSSocketFactory()). ... .build(); | |
Else if using HttpClient: | |
sample for legacy apache http library: https://github.com/Kane-Shih/TestApacheHttpClient | |
=> see: https://stackoverflow.com/questions/2603691/android-httpclient-and-https | |
https://stackoverflow.com/questions/28391798/how-to-set-tls-version-on-apache-httpclient | |
See also: | |
https://blog.dev-area.net/2015/08/13/android-4-1-enable-tls-1-1-and-tls-1-2/ | |
https://github.com/square/okhttp/issues/2200 | |
2. To protect against SSL exploits | |
See GMSProviderInstall_snippet.java | |
See also: | |
https://blog.dev-area.net/2015/08/17/protect-your-android-app-against-ssl-exploits/ | |
https://developer.android.com/training/articles/security-gms-provider.html | |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
import com.google.android.gms.common.GooglePlayServicesNotAvailableException; | |
import com.google.android.gms.common.GooglePlayServicesRepairableException; | |
import com.google.android.gms.security.ProviderInstaller; | |
try { | |
ProviderInstaller.installIfNeeded(getApplicationContext()); | |
/** | |
* https://developer.android.com/training/articles/security-gms-provider.html | |
* this can take anywhere from 30-50 milliseconds (on more recent devices) to 350 ms (on older devices) | |
* keywords: installIfNeeded(), installIfNeededAsync() | |
* | |
* Once the Provider is updated, all calls to security APIs (including SSL APIs) are routed through it. | |
* (However, this does not apply to android.net.SSLCertificateSocketFactory, | |
* which remains vulnerable to such exploits as CVE-2014-0224.) | |
* | |
*/ | |
} catch (GooglePlayServicesRepairableException e) { | |
e.printStackTrace(); | |
} catch (GooglePlayServicesNotAvailableException e) { | |
e.printStackTrace(); | |
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
package net.cogindo.ssl; | |
import java.io.IOException; | |
import java.net.InetAddress; | |
import java.net.Socket; | |
import java.net.UnknownHostException; | |
import java.security.KeyManagementException; | |
import java.security.NoSuchAlgorithmException; | |
import javax.net.ssl.SSLContext; | |
import javax.net.ssl.SSLSocket; | |
import javax.net.ssl.SSLSocketFactory; | |
/** | |
* https://blog.dev-area.net/2015/08/13/android-4-1-enable-tls-1-1-and-tls-1-2/ | |
* @author fkrauthan | |
*/ | |
public class TLSSocketFactory extends SSLSocketFactory { | |
private SSLSocketFactory internalSSLSocketFactory; | |
public TLSSocketFactory() throws KeyManagementException, NoSuchAlgorithmException { | |
SSLContext context = SSLContext.getInstance("TLS"); | |
context.init(null, null, null); | |
internalSSLSocketFactory = context.getSocketFactory(); | |
} | |
@Override | |
public String[] getDefaultCipherSuites() { | |
return internalSSLSocketFactory.getDefaultCipherSuites(); | |
} | |
@Override | |
public String[] getSupportedCipherSuites() { | |
return internalSSLSocketFactory.getSupportedCipherSuites(); | |
} | |
@Override | |
public Socket createSocket() throws IOException { | |
return enableTLSOnSocket(internalSSLSocketFactory.createSocket()); | |
} | |
@Override | |
public Socket createSocket(Socket s, String host, int port, boolean autoClose) throws IOException { | |
return enableTLSOnSocket(internalSSLSocketFactory.createSocket(s, host, port, autoClose)); | |
} | |
@Override | |
public Socket createSocket(String host, int port) throws IOException, UnknownHostException { | |
return enableTLSOnSocket(internalSSLSocketFactory.createSocket(host, port)); | |
} | |
@Override | |
public Socket createSocket(String host, int port, InetAddress localHost, int localPort) throws IOException, UnknownHostException { | |
return enableTLSOnSocket(internalSSLSocketFactory.createSocket(host, port, localHost, localPort)); | |
} | |
@Override | |
public Socket createSocket(InetAddress host, int port) throws IOException { | |
return enableTLSOnSocket(internalSSLSocketFactory.createSocket(host, port)); | |
} | |
@Override | |
public Socket createSocket(InetAddress address, int port, InetAddress localAddress, int localPort) throws IOException { | |
return enableTLSOnSocket(internalSSLSocketFactory.createSocket(address, port, localAddress, localPort)); | |
} | |
private Socket enableTLSOnSocket(Socket socket) { | |
if(socket != null && (socket instanceof SSLSocket)) { | |
((SSLSocket)socket).setEnabledProtocols(new String[] {"TLSv1.1", "TLSv1.2"}); | |
} | |
return socket; | |
} | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment