I'm developing an android app using ArcGIS Runtime SDK for Android 100.6.0 and it is getting a SSLHandshakeException since I updated my app to use a network security config.
The app do requests to two servers. One of them is a REST API in a develpment server accessible only in my company network. The other one is a public server running an ArcGIS Server. The ArcGIS Server's domain is able to communicate over TLS 1.2.
So, I expect everything to works just adding a rule to my private development server. This is the content of my network security config:
<SPAN class="prolog token"><?xml version="1.0" encoding="utf-8"?></SPAN>
<SPAN class="token tag"><SPAN class="token tag"><SPAN class="punctuation token"><</SPAN>network-security-config</SPAN> <SPAN class="attr-name token"><SPAN class="namespace token">xmlns:</SPAN>android</SPAN><SPAN class="attr-value token"><SPAN class="punctuation token">=</SPAN><SPAN class="punctuation token">"</SPAN>http://schemas.android.com/apk/res/android<SPAN class="punctuation token">"</SPAN></SPAN><SPAN class="punctuation token">></SPAN></SPAN>
<SPAN class="token tag"><SPAN class="token tag"><SPAN class="punctuation token"><</SPAN>domain-config</SPAN> <SPAN class="attr-name token">cleartextTrafficPermitted</SPAN><SPAN class="attr-value token"><SPAN class="punctuation token">=</SPAN><SPAN class="punctuation token">"</SPAN>true<SPAN class="punctuation token">"</SPAN></SPAN><SPAN class="punctuation token">></SPAN></SPAN>
<SPAN class="token tag"><SPAN class="token tag"><SPAN class="punctuation token"><</SPAN>domain</SPAN> <SPAN class="attr-name token">includeSubdomains</SPAN><SPAN class="attr-value token"><SPAN class="punctuation token">=</SPAN><SPAN class="punctuation token">"</SPAN>true<SPAN class="punctuation token">"</SPAN></SPAN><SPAN class="punctuation token">></SPAN></SPAN>172.17.1.14<SPAN class="token tag"><SPAN class="token tag"><SPAN class="punctuation token"></</SPAN>domain</SPAN><SPAN class="punctuation token">></SPAN></SPAN>
<SPAN class="token tag"><SPAN class="token tag"><SPAN class="punctuation token"></</SPAN>domain-config</SPAN><SPAN class="punctuation token">></SPAN></SPAN>
<SPAN class="token tag"><SPAN class="token tag"><SPAN class="punctuation token"></</SPAN>network-security-config</SPAN><SPAN class="punctuation token">></SPAN></SPAN>Unfortunately, any requests to my ArcGIS Server (using ArcGIS Runtime SDK for Android) are resulting in the following exception:
Caused by<SPAN class="operator token">:</SPAN> java<SPAN class="punctuation token">.</SPAN>security<SPAN class="punctuation token">.</SPAN>cert<SPAN class="punctuation token">.</SPAN>CertificateException<SPAN class="operator token">:</SPAN> Domain specific configurations require that hostname aware <SPAN class="token function">checkServerTrusted</SPAN><SPAN class="punctuation token">(</SPAN>X509Certificate<SPAN class="punctuation token">[</SPAN><SPAN class="punctuation token">]</SPAN><SPAN class="punctuation token">,</SPAN> String<SPAN class="punctuation token">,</SPAN> String<SPAN class="punctuation token">)</SPAN> is used
at android<SPAN class="punctuation token">.</SPAN>security<SPAN class="punctuation token">.</SPAN>net<SPAN class="punctuation token">.</SPAN>config<SPAN class="punctuation token">.</SPAN>RootTrustManager<SPAN class="punctuation token">.</SPAN><SPAN class="token function">checkServerTrusted</SPAN><SPAN class="punctuation token">(</SPAN>RootTrustManager<SPAN class="punctuation token">.</SPAN>java<SPAN class="operator token">:</SPAN><SPAN class="number token">111</SPAN><SPAN class="punctuation token">)</SPAN>
at com<SPAN class="punctuation token">.</SPAN>esri<SPAN class="punctuation token">.</SPAN>arcgisruntime<SPAN class="punctuation token">.</SPAN>internal<SPAN class="punctuation token">.</SPAN>e<SPAN class="punctuation token">.</SPAN>a<SPAN class="punctuation token">.</SPAN>a<SPAN class="punctuation token">.</SPAN><SPAN class="token function">checkServerTrusted</SPAN><SPAN class="punctuation token">(</SPAN>SourceFile<SPAN class="operator token">:</SPAN><SPAN class="number token">161</SPAN><SPAN class="punctuation token">)</SPAN>
at com<SPAN class="punctuation token">.</SPAN>android<SPAN class="punctuation token">.</SPAN>org<SPAN class="punctuation token">.</SPAN>conscrypt<SPAN class="punctuation token">.</SPAN>Platform<SPAN class="punctuation token">.</SPAN><SPAN class="token function">checkServerTrusted</SPAN><SPAN class="punctuation token">(</SPAN>Platform<SPAN class="punctuation token">.</SPAN>java<SPAN class="operator token">:</SPAN><SPAN class="number token">212</SPAN><SPAN class="punctuation token">)</SPAN>
at com<SPAN class="punctuation token">.</SPAN>android<SPAN class="punctuation token">.</SPAN>org<SPAN class="punctuation token">.</SPAN>conscrypt<SPAN class="punctuation token">.</SPAN>ConscryptFileDescriptorSocket<SPAN class="punctuation token">.</SPAN><SPAN class="token function">verifyCertificateChain</SPAN><SPAN class="punctuation token">(</SPAN>ConscryptFileDescriptorSocket<SPAN class="punctuation token">.</SPAN>java<SPAN class="operator token">:</SPAN><SPAN class="number token">404</SPAN><SPAN class="punctuation token">)</SPAN>
at com<SPAN class="punctuation token">.</SPAN>android<SPAN class="punctuation token">.</SPAN>org<SPAN class="punctuation token">.</SPAN>conscrypt<SPAN class="punctuation token">.</SPAN>NativeCrypto<SPAN class="punctuation token">.</SPAN><SPAN class="token function">SSL_do_handshake</SPAN><SPAN class="punctuation token">(</SPAN>Native Method<SPAN class="punctuation token">)</SPAN>
at com<SPAN class="punctuation token">.</SPAN>android<SPAN class="punctuation token">.</SPAN>org<SPAN class="punctuation token">.</SPAN>conscrypt<SPAN class="punctuation token">.</SPAN>NativeSsl<SPAN class="punctuation token">.</SPAN><SPAN class="token function">doHandshake</SPAN><SPAN class="punctuation token">(</SPAN>NativeSsl<SPAN class="punctuation token">.</SPAN>java<SPAN class="operator token">:</SPAN><SPAN class="number token">375</SPAN><SPAN class="punctuation token">)</SPAN>
at com<SPAN class="punctuation token">.</SPAN>android<SPAN class="punctuation token">.</SPAN>org<SPAN class="punctuation token">.</SPAN>conscrypt<SPAN class="punctuation token">.</SPAN>ConscryptFileDescriptorSocket<SPAN class="punctuation token">.</SPAN><SPAN class="token function">startHandshake</SPAN><SPAN class="punctuation token">(</SPAN>ConscryptFileDescriptorSocket<SPAN class="punctuation token">.</SPAN>java<SPAN class="operator token">:</SPAN><SPAN class="number token">224</SPAN><SPAN class="punctuation token">)</SPAN><SPAN class="line-numbers-rows"><SPAN></SPAN><SPAN></SPAN><SPAN></SPAN><SPAN></SPAN><SPAN></SPAN><SPAN></SPAN><SPAN></SPAN><SPAN></SPAN></SPAN>Since my ArcGIS Server server has a valid certificate and is TLS 1.2 aware, it would not happen, right?
The following network security config works fine, but it is insecure:
<SPAN class="prolog token"><?xml version="1.0" encoding="utf-8"?></SPAN>
<SPAN class="token tag"><SPAN class="token tag"><SPAN class="punctuation token"><</SPAN>network-security-config</SPAN> <SPAN class="attr-name token"><SPAN class="namespace token">xmlns:</SPAN>android</SPAN><SPAN class="attr-value token"><SPAN class="punctuation token">=</SPAN><SPAN class="punctuation token">"</SPAN>http://schemas.android.com/apk/res/android<SPAN class="punctuation token">"</SPAN></SPAN><SPAN class="punctuation token">></SPAN></SPAN>
<SPAN class="token tag"><SPAN class="token tag"><SPAN class="punctuation token"><</SPAN>base-config</SPAN> <SPAN class="attr-name token">cleartextTrafficPermitted</SPAN><SPAN class="attr-value token"><SPAN class="punctuation token">=</SPAN><SPAN class="punctuation token">"</SPAN>true<SPAN class="punctuation token">"</SPAN></SPAN><SPAN class="punctuation token">></SPAN></SPAN>
<SPAN class="token tag"><SPAN class="token tag"><SPAN class="punctuation token"><</SPAN>trust-anchors</SPAN><SPAN class="punctuation token">></SPAN></SPAN>
<SPAN class="token tag"><SPAN class="token tag"><SPAN class="punctuation token"><</SPAN>certificates</SPAN> <SPAN class="attr-name token">src</SPAN><SPAN class="attr-value token"><SPAN class="punctuation token">=</SPAN><SPAN class="punctuation token">"</SPAN>system<SPAN class="punctuation token">"</SPAN></SPAN> <SPAN class="punctuation token">/></SPAN></SPAN>
<SPAN class="token tag"><SPAN class="token tag"><SPAN class="punctuation token"></</SPAN>trust-anchors</SPAN><SPAN class="punctuation token">></SPAN></SPAN>
<SPAN class="token tag"><SPAN class="token tag"><SPAN class="punctuation token"></</SPAN>base-config</SPAN><SPAN class="punctuation token">></SPAN></SPAN>
<SPAN class="token tag"><SPAN class="token tag"><SPAN class="punctuation token"></</SPAN>network-security-config</SPAN><SPAN class="punctuation token">></SPAN></SPAN><SPAN class="line-numbers-rows"><SPAN></SPAN><SPAN></SPAN><SPAN></SPAN><SPAN></SPAN><SPAN></SPAN><SPAN></SPAN><SPAN></SPAN><SPAN></SPAN></SPAN>In addiction, I read that Facebook's Audience Network Android SDK also experienced issues with the network security configuration because they cache files at localhost. I've tried the same solution proposed by them but it also didn't work: https://developers.facebook.com/docs/audience-network/android-network-security-config/
What did I have done wrong? Does the Runtime SDK do intermediate requests like FB? Sniffing the android emulator network did not show up any requests other then expected.
