okHTTP 找不到可接受的协议（android）答案

【问题标题】：okHTTP Unable to find acceptable protocols(android)okHTTP 找不到可接受的协议（android）
【发布时间】：2015-12-02 05:38:18
【问题描述】：

对不起我的英语。我尝试使用库 OKhttp，并使用 https 进行发布请求。现在我有错误，当我尝试发布我的示例时，这是错误：

java.net.UnknownServiceException: Unable to find acceptable protocols. isFallback=false, modes=[ConnectionSpec(cipherSuites=[TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA], tlsVersions=[TLS_1_2], supportsTlsExtensions=true)], supported protocols=[SSLv3, TLSv1]

我尝试修复它，但我不能这样做。我不知道我有什么错误

下面是我的代码：

public class PostOKhttp extends AsyncTask<String, Void, String> {

        @Override
        protected String doInBackground(String...ulr) {
            Response response = null;
            OkHttpClient client = new OkHttpClient();
            ConnectionSpec spec = new ConnectionSpec.Builder(ConnectionSpec.MODERN_TLS)
                    .tlsVersions(TlsVersion.TLS_1_2)
                    .cipherSuites(
                            CipherSuite.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
                            CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
                            CipherSuite.TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,
                            CipherSuite.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
                            CipherSuite.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
                            CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
                            CipherSuite.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
                            CipherSuite.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,
                            CipherSuite.TLS_ECDHE_RSA_WITH_RC4_128_SHA,
                            CipherSuite.TLS_DHE_RSA_WITH_AES_128_CBC_SHA)
                    .build();
            client.setConnectionSpecs(Collections.singletonList(spec));

            RequestBody postForm = new FormEncodingBuilder()
                    .add("name", "name")
                    .build();

            Request request = new Request.Builder()
                    .url(ulr[0])
                    .addHeader("id", "--")
                    .addHeader("key", "--")
                    .post(postForm)
                    .build();

            try {
                response = client.newCall(request).execute();
                Log.e("post", response.body().string());

            } catch (Exception e) {
                Log.e("error", e.toString());
            }
            return null;

        }

        @Override
        protected void onPostExecute(String result) {

        }

UDP：

使用 CertificatePinner

我添加此代码

String link = "example.net";
CertificatePinner certificatePinner = new CertificatePinner.Builder()
                    .add(link, "sha1/DmxUShsZuNiqPQsX2Oi9uv2sCnw=")
                    .add(link, "sha1/SXxoaOSEzPC6BgGmxAt/EAcsajw=")
                    .add(link, "sha1/blhOM3W9V/bVQhsWAcLYwPU6n24=")
                    .add(link, "sha1/T5x9IXmcrQ7YuQxXnxoCmeeQ84c=")
                    .build();

            client.setCertificatePinner(certificatePinner);

现在我有这个错误：

javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.

【问题讨论】：

那么您的后端是否支持 TLS1.2 以及您列出的至少一种密码套件？
@laalto 如果我使用 TLS_1_0 或 TLS_1_1 我有同样的错误
输出的 `supportedprotocols=[SSLv3, TLSv1]` 部分表明您的后端仅支持古老的 TLS1.0 和过时的 SSL3，并且没有您声明的密码套件。
如果您使用自签名证书，请使用 CertificatePinner 固定它们。但请考虑将您的服务器升级到现代 TLS，而不是恢复到安全性较低的旧协议和密码。
@laalto 感谢您的回答。我更新了我的问题，现在我添加了CertificatePinner ，我有错误SSLHandshakeException

标签： android ssl https

【解决方案1】：

实际上问题是 TLSv1.1 和 TLSv1.2 在 Android 上默认未启用，并使用这些最新的安全连接我们必须在 Android

因为默认情况下，android 设备会选择支持的最高协议来建立连接，但默认情况下不启用最高/最新的安全协议（例如 TLSV1.1 或 TLSV1.2）（仅启用 SSLV3.0 或 TLSV1。 0).

在android中启用TLSV1.1和TLSV1.2

import java.io.IOException; import java.net.InetAddress; import java.net.Socket; import java.net.UnknownHostException; import java.security.KeyManagementException; import java.security.NoSuchAlgorithmException; import javax.net.ssl.SSLContext; import javax.net.ssl.SSLSocket; import javax.net.ssl.SSLSocketFactory; /** * @author Bajrang Hudda */ public class MyTLSSocketFactory extends SSLSocketFactory { private SSLSocketFactory internalSSLSocketFactory; public MyTLSSocketFactory() throws KeyManagementException, NoSuchAlgorithmException { SSLContext context = SSLContext.getInstance("TLS"); context.init(null, null, null); internalSSLSocketFactory = context.getSocketFactory(); } @Override public String[] getDefaultCipherSuites() { return internalSSLSocketFactory.getDefaultCipherSuites(); } @Override public String[] getSupportedCipherSuites() { return internalSSLSocketFactory.getSupportedCipherSuites(); } @Override public Socket createSocket() throws IOException { return enableTLSOnSocket(internalSSLSocketFactory.createSocket()); } @Override public Socket createSocket(Socket s, String host, int port, boolean autoClose) throws IOException { return enableTLSOnSocket(internalSSLSocketFactory.createSocket(s, host, port, autoClose)); } @Override public Socket createSocket(String host, int port) throws IOException, UnknownHostException { return enableTLSOnSocket(internalSSLSocketFactory.createSocket(host, port)); } @Override public Socket createSocket(String host, int port, InetAddress localHost, int localPort) throws IOException, UnknownHostException { return enableTLSOnSocket(internalSSLSocketFactory.createSocket(host, port, localHost, localPort)); } @Override public Socket createSocket(InetAddress host, int port) throws IOException { return enableTLSOnSocket(internalSSLSocketFactory.createSocket(host, port)); } @Override public Socket createSocket(InetAddress address, int port, InetAddress localAddress, int localPort) throws IOException { return enableTLSOnSocket(internalSSLSocketFactory.createSocket(address, port, localAddress, localPort)); } private Socket enableTLSOnSocket(Socket socket) { if(socket != null && (socket instanceof SSLSocket)) { ((SSLSocket)socket).setEnabledProtocols(new String[] {"TLSv1.1", "TLSv1.2"}); } return socket; } }

现在将它添加到您的 Okhttpclient 中 -

protected static OkHttpClient getHttpClient(long timeout){ String hostname = Constants.HOST_NAME_DEBUG; CertificatePinner certificatePinner = new CertificatePinner.Builder() .add(hostname, "sha1/mBN/TTGneHe2Hq0yFG+SRt5nMZQ=") .add(hostname, "sha1/6CgvsAgBlX3PYiYRGedC0NZw7ys=") .build(); //specifying the specs; this is impotent otherwise android <5 won't work //And do note to include the android < 5 supported specs. ConnectionSpec spec = new ConnectionSpec.Builder(ConnectionSpec.MODERN_TLS) .tlsVersions(TlsVersion.TLS_1_1, TlsVersion.TLS_1_2) .cipherSuites( CipherSuite.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, CipherSuite.TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) .build(); final OkHttpClient okHttpClient = new OkHttpClient(); okHttpClient.setCertificatePinner(certificatePinner); okHttpClient.setConnectionSpecs(Collections.singletonList(spec)); try { // enabling the tlsv1.1 and tlsv.2 okHttpClient.setSslSocketFactory(new MyTLSSocketFactory()); } catch (KeyManagementException e) { e.printStackTrace(); } catch (NoSuchAlgorithmException e) { e.printStackTrace(); } return okHttpClient; }

现在终于将它添加到您的改造中 -

RestAdapter restAdapter = new RestAdapter.Builder() .setEndpoint(Constants.API_URL) .setLogLevel(RestAdapter.LogLevel.FULL) .setErrorHandler(new ErrorHandler()) .setClient(getHttpClient()) .setRequestInterceptor(new SecureHeaderInterceptor(null)) .build();

就是这样，快乐编码:-)

【讨论】：

我试过你的代码，但我得到了错误The method setCertificatePinner(CertificatePinner) is undefined for the type OkHttpClient，为什么？
您可能没有使用最新版本的 okhttp，请参阅 -square.github.io/okhttp/3.x/okhttp/okhttp3/…
这是在我的 build.gradle 文件中compile 'com.squareup.okhttp3:okhttp:3.12.0'，是不是旧的？
好的，给我看看你试图调用这个方法的代码。
您是仅使用 com.squareup.okhttp.OkHttpClient 类还是任何其他导入？因为这是正确的。

【解决方案2】：

如果需要 TLS 支持，您需要使用 ProviderInstaller 来检查和安装。在您的条目Activity 上使用类似的东西，它应该可以解决问题。查看更多信息here

protected void checkTls() {
    if (android.os.Build.VERSION.SDK_INT < 21) {
        try {
            ProviderInstaller.installIfNeededAsync(this, new ProviderInstaller.ProviderInstallListener() {
                @Override
                public void onProviderInstalled() {
                    SSLContext sslContext = null;
                    try {
                        sslContext = SSLContext.getInstance("TLSv1.2");
                        sslContext.init(null, null, null);
                        SSLEngine engine = sslContext.createSSLEngine();
                    } catch (NoSuchAlgorithmException e) {
                        e.printStackTrace();
                    } catch (KeyManagementException e) {
                        e.printStackTrace();
                    }

                }

                @Override
                public void onProviderInstallFailed(int i, Intent intent) {
                }
            });
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

【讨论】：

谢谢！这解决了我的问题