Question

我的应用程序当前正在运行tlsv1.0或1.1，并且想要更新tls版本1.2，但仍显示旧版本tls1.0或tls1.1，但未显示1.2。示例代码：

public class TLSSocketFactoryNew extends SSLSocketFactory {

    private SSLSocketFactory internalSSLSocketFactory;

    public TLSSocketFactoryNew() throws KeyManagementException, NoSuchAlgorithmException {
        SSLContext context = SSLContext.getInstance("TLSv1.2");
        TrustManager[] managers = new TrustManager[] { new TrustManagerManipulator() };
        context.init(null, managers, new SecureRandom());
        internalSSLSocketFactory = context.getSocketFactory();

    }

    @Override
    public String[] getDefaultCipherSuites() {
        return internalSSLSocketFactory.getDefaultCipherSuites();
    }

    @Override
    public String[] getSupportedCipherSuites() {
        return internalSSLSocketFactory.getSupportedCipherSuites();
    }

    @Override
    public Socket createSocket(Socket s, String host, int port, boolean autoClose) throws IOException {
        return enableTLSOnSocket(internalSSLSocketFactory.createSocket(s, host, port, autoClose));
    }

    @Override
    public Socket createSocket(String host, int port) throws IOException, UnknownHostException {
        return enableTLSOnSocket(internalSSLSocketFactory.createSocket(host, port));
    }

    @Override
    public Socket createSocket(String host, int port, InetAddress localHost, int localPort) throws IOException, UnknownHostException {
        return enableTLSOnSocket(internalSSLSocketFactory.createSocket(host, port, localHost, localPort));
    }

    @Override
    public Socket createSocket(InetAddress host, int port) throws IOException {
        return enableTLSOnSocket(internalSSLSocketFactory.createSocket(host, port));
    }

    @Override
    public Socket createSocket(InetAddress address, int port, InetAddress localAddress, int localPort) throws IOException {
        return enableTLSOnSocket(internalSSLSocketFactory.createSocket(address, port, localAddress, localPort));
    }

    /*
     * Utility methods
     */

    private static Socket enableTLSOnSocket(Socket socket) {
        if (socket != null && (socket instanceof SSLSocket)
                && isTLSServerEnabled((SSLSocket) socket)) { // skip the fix if server doesn't provide there TLS version
            ((SSLSocket)socket).setEnabledProtocols(new String[] {"TLSv1.2"});
        }
        return socket;
    }

    private static boolean isTLSServerEnabled(SSLSocket sslSocket) {
        System.out.println("isTLSServerEnabled :: " + sslSocket.getSupportedProtocols().toString());
        for (String protocol : sslSocket.getSupportedProtocols()) {
            if (protocol.equals("TLSv1.1") || protocol.equals("TLSv1.2")) {
                return true;
            }
        }
        return false;
    }
}

我现在关心的是，我只想使我的应用程序仅支持tlsv1.2版本，应避免使用所有旧版本。

我如何在实用程序类中仅使用 httpclient 进行调用 TLSSocketFactoryNew 的方式-不需要有关 okhttp ，的解决方案httpurlconnection 。

Util.java

HttpClient mHttpClient= returnHttpClient(httpParams);

并获取httpclient

private HttpClient returnHttpClient(HttpParams httpParams) {
    SchemeRegistry registry = new SchemeRegistry();
    try {
      registry.register(new Scheme("https", (SocketFactory) new TLSSocketFactoryNew(), 443));
    } catch (KeyManagementException e) {
      e.printStackTrace();
    } catch (NoSuchAlgorithmException e) {
      e.printStackTrace();
    }
    HttpClient client = new DefaultHttpClient(new ThreadSafeClientConnManager(httpParams, registry),httpParams);
    return  client;
  }

我在Activity的oncreate内部添加了此片段，

try {
            ProviderInstaller.installIfNeeded(getBaseContext());
        } catch (GooglePlayServicesRepairableException e) {
            e.printStackTrace();
        } catch (GooglePlayServicesNotAvailableException e) {
            e.printStackTrace();
        }

和依赖项：

compile 'com.google.android.gms:play-services-base:11.0.1'
compile files('libs/commons-codec-1.9.jar')
compile files('libs/commons-logging-1.1.1.jar')
compile files('libs/core-1.51.0.0.jar')
//  compile files('libs/httpclient-4.0.1.jar')
compile files('libs/httpcore-4.0.1.jar')
compile files('libs/jackson-core-2.7.2.jar')
compile files('libs/jsonic-1.3.0.jar')

我在这里提出要点，在那里我将tls版本升级到v1.2是错误的，我的代码中是否缺少某些内容？

谢谢。

Answer 1

首先请确保您在此计算机上运行的所有计算机都启用了TLS 1.2。

设置SSLContext：

SSLContext sslContext = SSLContextBuilder.create().useProtocol("TLSv1.2").build();

然后使用HttpClientBuilder构建您的HttpClient：

HttpClientBuilder builder = HttpClientBuilder.create();
builder.setSSLContext(sslContext);

Answer 2

这对您有帮助，完全一样的问题，我通过以下剪裁解决了

只需获取HttpClient：

private HttpClient getHttpClient(HttpParams httpParams) {
    SSLContext sslContext = null;
 try {
        sslContext = SSLContext.getInstance("TLSv1.2");
        sslContext.init(null, null, null);
        SSLSocketFactory delegate = null;
        delegate = new TLSSocketFactory(sslContext.getSocketFactory());
        HttpsURLConnection.setDefaultSSLSocketFactory(delegate);
        SSLSocketFactory socketFactory = SSLSocketFactory.getSocketFactory();
        HttpClient httpclient = new DefaultHttpClient(httpParams);
        httpclient.getConnectionManager().getSchemeRegistry().register(new Scheme("https", socketFactory, 443));
       return httpclient;
 } catch (NoSuchAlgorithmException e) {
        throw new RuntimeException(e);
 } catch (Exception e) {
        throw new RuntimeException(e);
 }
}

和TLSSocketFactory.java文件应为

import java.io.IOException;
import java.net.InetAddress;
import java.net.Socket;
import java.net.UnknownHostException;

import javax.net.ssl.SSLSocket;
import javax.net.ssl.SSLSocketFactory;

public class TLSSocketFactory extends SSLSocketFactory {
    private static final String[] TLS_V12_ONLY = {"TLSv1.2"};

    final SSLSocketFactory delegate;

    public TLSSocketFactory(SSLSocketFactory base) {
        this.delegate = base;
    }

    @Override
    public String[] getDefaultCipherSuites() {
        return delegate.getDefaultCipherSuites();
    }

    @Override
    public String[] getSupportedCipherSuites() {
        return delegate.getSupportedCipherSuites();
    }

    @Override
    public Socket createSocket(Socket s, String host, int port, boolean autoClose) throws IOException {
        return patch(delegate.createSocket(s, host, port, autoClose));
    }

    @Override
    public Socket createSocket(String host, int port) throws IOException, UnknownHostException {
        return patch(delegate.createSocket(host, port));
    }

    @Override
    public Socket createSocket(String host, int port, InetAddress localHost, int localPort) throws IOException, UnknownHostException {
        return patch(delegate.createSocket(host, port, localHost, localPort));
    }

    @Override
    public Socket createSocket(InetAddress host, int port) throws IOException {
        return patch(delegate.createSocket(host, port));
    }

    @Override
    public Socket createSocket(InetAddress address, int port, InetAddress localAddress, int localPort) throws IOException {
        return patch(delegate.createSocket(address, port, localAddress, localPort));
    }

    private Socket patch(Socket s) {
        if (s instanceof SSLSocket) {
            ((SSLSocket) s).setEnabledProtocols(TLS_V12_ONLY);
        }
        return s;
    }
}

如果您想了解更多信息，请访问以下链接：

https://blog.dev-area.net/2015/08/13/android-4-1-enable-tls-1-1-and-tls-1-2/

https://medium.com/tech-quizlet/working-with-tls-1-2-on-android-4-4-and-lower-f4f5205629a

使用httpclient在android中升级到TLSV1.0或1.1到TLSV1.2

2 个答案: