Enable TLS 1.2 in Android 4.4

00_READ_ME.txt

1. To enable TLS 1.2 in Android 4.4
  Copy TLSSocketFactory.java

  If using HttpsURLConnection:
    => conn.setSSLSocketFactory(new TLSSocketFactory());
  Else if using OkHttp:
    => new OkHttpClient.Builder().setSocketFactory(new TLSSocketFactory()). ... .build();
  Else if using HttpClient:
       sample for legacy apache http library: https://github.com/Kane-Shih/TestApacheHttpClient
    => see: https://stackoverflow.com/questions/2603691/android-httpclient-and-https
            https://stackoverflow.com/questions/28391798/how-to-set-tls-version-on-apache-httpclient
    
  See also: 
    https://blog.dev-area.net/2015/08/13/android-4-1-enable-tls-1-1-and-tls-1-2/
    https://github.com/square/okhttp/issues/2200

2. To protect against SSL exploits
  See GMSProviderInstall_snippet.java
  
  See also:
    https://blog.dev-area.net/2015/08/17/protect-your-android-app-against-ssl-exploits/
    https://developer.android.com/training/articles/security-gms-provider.html
      

GMSProviderInstall_snippet.java

import com.google.android.gms.common.GooglePlayServicesNotAvailableException;
import com.google.android.gms.common.GooglePlayServicesRepairableException;
import com.google.android.gms.security.ProviderInstaller;

try {
    ProviderInstaller.installIfNeeded(getApplicationContext());
  
    /**
    * https://developer.android.com/training/articles/security-gms-provider.html
    * this can take anywhere from 30-50 milliseconds (on more recent devices) to 350 ms (on older devices)
    * keywords: installIfNeeded(), installIfNeededAsync()
    *
    * Once the Provider is updated, all calls to security APIs (including SSL APIs) are routed through it. 
    * (However, this does not apply to android.net.SSLCertificateSocketFactory, 
    * which remains vulnerable to such exploits as CVE-2014-0224.)
    *
    */
  
} catch (GooglePlayServicesRepairableException e) {
    e.printStackTrace();
} catch (GooglePlayServicesNotAvailableException e) {
    e.printStackTrace();
}

TLSSocketFactory.java

package net.cogindo.ssl;

import java.io.IOException;
import java.net.InetAddress;
import java.net.Socket;
import java.net.UnknownHostException;
import java.security.KeyManagementException;
import java.security.NoSuchAlgorithmException;

import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSocket;
import javax.net.ssl.SSLSocketFactory;

/**
 * https://blog.dev-area.net/2015/08/13/android-4-1-enable-tls-1-1-and-tls-1-2/
 * @author fkrauthan
 */
public class TLSSocketFactory extends SSLSocketFactory {

    private SSLSocketFactory internalSSLSocketFactory;

    public TLSSocketFactory() throws KeyManagementException, NoSuchAlgorithmException {
        SSLContext context = SSLContext.getInstance("TLS");
        context.init(null, null, null);
        internalSSLSocketFactory = context.getSocketFactory();
    }

    @Override
    public String[] getDefaultCipherSuites() {
        return internalSSLSocketFactory.getDefaultCipherSuites();
    }

    @Override
    public String[] getSupportedCipherSuites() {
        return internalSSLSocketFactory.getSupportedCipherSuites();
    }
    
    @Override
    public Socket createSocket() throws IOException {
        return enableTLSOnSocket(internalSSLSocketFactory.createSocket());
    }

    @Override
    public Socket createSocket(Socket s, String host, int port, boolean autoClose) throws IOException {
        return enableTLSOnSocket(internalSSLSocketFactory.createSocket(s, host, port, autoClose));
    }

    @Override
    public Socket createSocket(String host, int port) throws IOException, UnknownHostException {
        return enableTLSOnSocket(internalSSLSocketFactory.createSocket(host, port));
    }

    @Override
    public Socket createSocket(String host, int port, InetAddress localHost, int localPort) throws IOException, UnknownHostException {
        return enableTLSOnSocket(internalSSLSocketFactory.createSocket(host, port, localHost, localPort));
    }

    @Override
    public Socket createSocket(InetAddress host, int port) throws IOException {
        return enableTLSOnSocket(internalSSLSocketFactory.createSocket(host, port));
    }

    @Override
    public Socket createSocket(InetAddress address, int port, InetAddress localAddress, int localPort) throws IOException {
        return enableTLSOnSocket(internalSSLSocketFactory.createSocket(address, port, localAddress, localPort));
    }

    private Socket enableTLSOnSocket(Socket socket) {
        if(socket != null && (socket instanceof SSLSocket)) {
            ((SSLSocket)socket).setEnabledProtocols(new String[] {"TLSv1.1", "TLSv1.2"});
        }
        return socket;
    }
}

Thanks so much, you save my days!

役に立つだ。本当にありがとうございました