更新
我在API 16模拟器上还遇到了另一个错误:
routines:SSL23_GET_SERVER_HELLO:tlsv1 alert protocol version
(external/openssl/ssl/s23_clnt.c:741'。
阅读1和2,我修改了代码如下:
val okHttpClient = getOkHttpBuilder().build()
private fun getOkHttpBuilder(): OkHttpClient.Builder {
if (Build.VERSION.SDK_INT < Build.VERSION_CODES.M) {
Security.insertProviderAt(Conscrypt.newProvider(), 1)
}
return OkHttpClient().newBuilder()
}
implementation 'org.conscrypt:conscrypt-android:2.5.1'
但是这个库会使apk增加3.4 Mb。
我还从MyApplication
中删除了这些行:
try {
ProviderInstaller.installIfNeeded(applicationContext)
val sslContext = SSLContext.getInstance("TLSv1.2")
sslContext.init(null, null, null)
sslContext.createSSLEngine()
} catch (e: GooglePlayServicesRepairableException) {
Timber.e(e.stackTraceToString())
GoogleApiAvailability.getInstance().showErrorNotification(this, e.connectionStatusCode)
} catch (e: GooglePlayServicesNotAvailableException) {
Timber.e(e.stackTraceToString())
} catch (e: NoSuchAlgorithmException) {
Timber.e(e.stackTraceToString())
} catch (e: KeyManagementException) {
Timber.e(e.stackTraceToString())
}
=== 旧回答 ===
在我的情况下,在Android 4和5上引发了以下错误:
由于:
com.android.org.bouncycastle.jce.exception.ExtCertPathValidatorException:
无法验证证书:证书已于2020年5月30日过期
10:48:38 GMT+00:00(与2020年8月13日11:47:00 GMT+00:00相比)
...
由于:java.security.cert.CertificateExpiredException:
证书已于2020年5月30日过期
10:48:38 GMT+00:00(与2020年8月13日11:47:00 GMT+00:00相比)
服务器存在证书错误(可能已过期)。
对于 Retrofit
,请参见https://dev59.com/3Ww15IYBdhLWcg3wGn9c#60507560。如果您使用 Fuel
作为REST库,请参见kotlin library that can do httpS connection without certificate verification (like curl --insecure)。
您可以信任所有证书,但这是危险的。
import java.security.SecureRandom
import java.security.cert.X509Certificate
import javax.net.ssl.*
import javax.security.cert.CertificateException
companion object {
private val gson: Gson
private val retrofit: Retrofit
init {
val okHttpClient = getOkHttpBuilder().build()
gson = GsonBuilder().setLenient().create()
retrofit = Retrofit.Builder()
.baseUrl(BASE_URL)
.client(okHttpClient)
.addConverterFactory(GsonConverterFactory.create(gson))
.build()
}
private fun getOkHttpBuilder(): OkHttpClient.Builder =
if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
OkHttpClient().newBuilder()
} else {
getUnsafeOkHttpClient()
}
private fun getUnsafeOkHttpClient(): OkHttpClient.Builder =
try {
val trustAllCerts: Array<TrustManager> = arrayOf(
object : X509TrustManager {
@Throws(CertificateException::class)
override fun checkClientTrusted(chain: Array<X509Certificate?>?,
authType: String?) = Unit
@Throws(CertificateException::class)
override fun checkServerTrusted(chain: Array<X509Certificate?>?,
authType: String?) = Unit
override fun getAcceptedIssuers(): Array<X509Certificate> = arrayOf()
}
)
val sslContext: SSLContext = SSLContext.getInstance("SSL")
sslContext.init(null, trustAllCerts, SecureRandom())
val sslSocketFactory: SSLSocketFactory = sslContext.socketFactory
val builder = OkHttpClient.Builder()
builder.sslSocketFactory(sslSocketFactory,
trustAllCerts[0] as X509TrustManager)
builder.hostnameVerifier { _, _ -> true }
builder
} catch (e: Exception) {
throw RuntimeException(e)
}
}
请参考https://dev59.com/3Ww15IYBdhLWcg3wGn9c#60507560来检查Android版本和连接Glide
.
Fuel
作为REST库,请参阅https://dev59.com/9qfja4cB1Zd3GeqPpAEc#54276837。 - CoolMind