Android Question okHttp - javax.net.ssl.SSLProtocolException SHA-256

MarcoRome · Feb 21, 2016

Hi all. Time ago i write time ago one library Paypal credit card, now seem that this library have a few problems with SSL, when i call:

B4X:

https://api.sandbox.paypal.com/v1/oauth2/token","grant_type=client_credentials")

find message i have this error:

javax.net.ssl.SSLPeerUnverifiedException: No peer certificate

After i change this line code:

B4X:

Change hc.Initialize in HttpUtils2Service to hc.InitializeAcceptAll

as suggestion Erel HERE

Now i have this error:

javax.net.ssl.SSLHandshakeException: javax.net.ssl.SSLProtocolException:
SSL handshake aborted: ssl=0x7a11ad08: Failure in SSL library, usually a protocol error
error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure (external/openssl/ssl/s23_clnt.c:741 0x74686718:0x00000000)

Any idea ?
Thank you
Marco

Erel · Feb 21, 2016

I've tried it with this code:

B4X:

Sub Activity_Create(FirstTime As Boolean)
   Dim j As HttpJob
   j.Initialize("", Me)
   j.Download("https://api.sandbox.paypal.com/v1/oauth2/token")
     
End Sub

Sub jobdone(j As HttpJob)
   Log(j)
End Sub

I'm not getting any SSL error. Note that I haven't called hc.InitializeAcceptAll.

MarcoRome · Feb 21, 2016

Erel i send project ( support@basic4ppc.com ) so you can try with this ( is few line code ).
Thank you very much
Marco

Erel · Feb 22, 2016

Have you tried to run the code I posted? Do you get an error?

MarcoRome · Feb 22, 2016

Yes i have some Error:

and without modified library ( hc.Initialize.... ), i use in this contest okHttp library + okHttpUtils2 library

Erel · Feb 22, 2016

Which device are you using?

Does it work with HttpUtils2 (not OkHttpUtils2)?

MarcoRome · Feb 22, 2016

This is error:

Installing file.
PackageAdded: package:b4a.example
** Service (starter) Create **
** Service (starter) Start **
** Activity (main) Create, isFirst = true **
** Activity (main) Resume **
** Service (httputils2service) Create **
** Service (httputils2service) Start **
[errormessage=javax.net.ssl.SSLHandshakeException: javax.net.ssl.SSLProtocolException: SSL handshake aborted: ssl=0x7abe6d98: Failure in SSL library, usually a protocol error
error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure (external/openssl/ssl/s23_clnt.c:741 0x74686718:0x00000000), httputils2service=null, jobname=
, password=, req=anywheresoftware.b4h.okhttp.OkHttpClientWrapper$OkHttpRequest@421e0438, username=
, tag=java.lang.Object@421e0450, target=class b4a.example.main, taskid=1
, success=false]

Compiled B4A 5.80 #1 / JDK 1.8.0_66 / android.jar ( 23 )

MarcoRome · Feb 22, 2016

Erel said:
Which device are you using?

Does it work with HttpUtils2 (not OkHttpUtils2)?

Samsung Note 3 and work with all apps ( that use httputils2 ) with out problem.

Erel · Feb 22, 2016

Not sure why it doesn't work on your device. It does work here with OkHttp. You will need to use Http for now.

MarcoRome · Feb 22, 2016

I have try also with HttpUtils2 ( 2.01 ) / Http ( 1.36 )
But i have some effect.
The thing strain is that work with a lot program that use HttpUtil and i havent this problem with another apps.
Today i try also with another devices.
anyway this is error:

** Service (starter) Create **
** Service (starter) Start **
** Activity (main) Create, isFirst = true **
** Activity (main) Resume **
** Service (httputils2service) Create **
** Service (httputils2service) Start **
[errormessage=javax.net.ssl.SSLPeerUnverifiedException: No peer certificate, httputils2service=null, jobname=
, password=, [EMAIL]req=anywheresoftware.b4a.http.HttpClientWrapper$HttpUriRequestWrapper@421b74d8[/EMAIL], username=
, tag=java.lang.Object@421b74f0, target=class b4a.example.main, taskid=1
, success=false]
-- AppUpdating.NewInst2: processing service_start
-- AppUpdating.NewInst2: processing service_start

Pendrush · Feb 22, 2016

Can you check date and time on testing device?

Pendrush · Feb 22, 2016

And please check this link
http://stackoverflow.com/a/34933173

MarcoRome · Feb 22, 2016

Pendrush said:
Can you check date and time on testing device?

Yes is correct

MarcoRome · Feb 22, 2016

Pendrush said:
And please check this link
http://stackoverflow.com/a/34933173

Here i read: "you must verify that your systems
are ready for this change by June 17, 2016"

Pendrush · Feb 22, 2016

Sandbox Endpoints - Ready Now
The PayPal Sandbox endpoints have been configured with the latest security standards to which the Production endpoints will be moving. You can use these endpoints to verify that your code supports the required standards prior to the Production endpoints getting updated. These endpoints have been upgraded to the new SHA-256, 2048-bit certificates:

api.sandbox.paypal.com
api-3t.sandbox.paypal.com
api-aa.sandbox.paypal.com
api-aa-3t.sandbox.paypal.com
svcs.sandbox.paypal.com
pointofsale.sandbox.paypal.com
ipnpb.sandbox.paypal.com
www.sandbox.paypal.com (for IPN)

Production Endpoints - Ready after June 17, 2016
The following Production endpoints will be upgraded to new SHA-256, 2048-bit certificates after June 17, 2016:

api.paypal.com
api-3t.paypal.com
api-aa.paypal.com
api-aa-3t.paypal.com
svcs.paypal.com
ipnpb.paypal.com

https://www.paypal-knowledge.com/infocenter/index?page=content&id=FAQ1766&expand=true&locale=en_US

MarcoRome · Feb 22, 2016

I realized this error because one of our colleagues (that use device Huawei with Android 4.2) has had this problem with Library PayPal CreditCard ( HERE )
So i try the library and actually the problem exists. Until december 2015 never had this problem.
Is it possibile that also THIS depends because they have made changes ?

Pendrush · Feb 22, 2016

For api.sandbox.paypal.com you need to use SHA-256, 2048-bit starting from January 19-20, 2016.

MarcoRome · Feb 22, 2016

Pendrush said:
For api.sandbox.paypal.com you need to use SHA-256, 2048-bit starting from January 19-20, 2016.

Yes i read

MarcoRome · Feb 22, 2016

But anyway this code should be valid:

B4X:

Sub Activity_Create(FirstTime As Boolean)
   Dim j As HttpJob
   j.Initialize("", Me)
   j.Download("https://api.sandbox.paypal.com/v1/oauth2/token")
    
End Sub

Sub jobdone(j As HttpJob)
   Log(j)
End Sub

or no ?

MarcoRome · Feb 22, 2016

Erel said:
Not sure why it doesn't work on your device. It does work here with OkHttp. You will need to use Http for now.

Maybe understand because dont work.

Looks that server is using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 cipher. It only started being supported in API 20 (L Preview). You can see a list of supported ciphers by API level on the SSLSocket docs.
Try running your test on a 5.0 or above device. For example, the following code is successful on a device running 5.0, but gets an SSL exception on 4.4.4 --

The issue is not retrofit or okhttp, but the limitations of the default security providers provided on older phones.
You can work around it by installing a new provider. Google makes one available through google play services, and is easy to install. One line (plus exception handling, etc).

"Updating Your Security Provider to Protect Against SSL Exploits" from Google.
Found this information HERE

Erel do you have any tricks ?

Android Question okHttp - javax.net.ssl.SSLProtocolException SHA-256

Expert

B4X founder

Expert

B4X founder

Expert

B4X founder

Expert

Expert

B4X founder

Expert

Well-Known Member

Well-Known Member

Expert

Expert

Well-Known Member

Expert

Well-Known Member

Expert

Expert

Expert

Similar Threads

Privacy & Transparency

Privacy & Transparency