https Android 5.0 以下TLS 版本过低造成的问题

异常如下

javax.net.ssl.SSLHandshakeException: javax.net.ssl.SSLProtocolException: SSL handshake aborted: ssl=0x610df808: Failure in SSL library, usually a protocol error
                                                error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure (external/openssl/ssl/s23_clnt.c:741 0x410f976a:0x00000000)
                                                    at org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:412)
                                                    at okhttp3.internal.connection.RealConnection.connectTls(Paramount:281)
                                                    at okhttp3.internal.connection.RealConnection.establishProtocol(Paramount:251)
                                                    at okhttp3.internal.connection.RealConnection.connect(Paramount:151)
                                                    at okhttp3.internal.connection.StreamAllocation.findConnection(Paramount:192)
                                                    at okhttp3.internal.connection.StreamAllocation.findHealthyConnection(Paramount:121)
                                                    at okhttp3.internal.connection.StreamAllocation.newStream(Paramount:100)
                                                    at okhttp3.internal.connection.ConnectInterceptor.intercept(Paramount:42)
                                                    at okhttp3.internal.http.RealInterceptorChain.proceed(Paramount:92)
                                                    at okhttp3.internal.http.RealInterceptorChain.proceed(Paramount:67)
                                                    at okhttp3.internal.cache.CacheInterceptor.intercept(Paramount:93)
                                                    at okhttp3.internal.http.RealInterceptorChain.proceed(Paramount:92)
                                                    at okhttp3.internal.http.RealInterceptorChain.proceed(Paramount:67)
                                                    at okhttp3.internal.http.BridgeInterceptor.intercept(Paramount:93)
                                                    at okhttp3.internal.http.RealInterceptorChain.proceed(Paramount:92)
                                                    at okhttp3.internal.http.RetryAndFollowUpInterceptor.intercept(Paramount:120)
                                                    at okhttp3.internal.http.RealInterceptorChain.proceed(Paramount:92)
                                                    at okhttp3.internal.http.RealInterceptorChain.proceed(Paramount:67)
                                                    at okhttp3.RealCall.getResponseWithInterceptorChain(Paramount:185)
                                                    at okhttp3.RealCall.execute(Paramount:69)
                                                    at com.qihoo.mm.paramount.tools.glide.j.b(Paramount:44)
                                                    at com.qihoo.mm.paramount.tools.glide.j.a(Paramount:21)
                                                    at com.bumptech.glide.load.b.f$a.b(Paramount:70)
                                                    at com.bumptech.glide.load.b.f$a.a(Paramount:53)
                                                    at com.bumptech.glide.load.engine.a.e(Paramount:170)
                                                    at com.bumptech.glide.load.engine.a.c(Paramount:128)
                                                    at com.bumptech.glide.load.engine.h.f(Paramount:122)
                                                    at com.bumptech.glide.load.engine.h.d(Paramount:101)
                                                    at com.bumptech.glide.load.engine.h.run(Paramount:58)
                                                    at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:442)
                                                    at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:305)
                                                    at java.util.concurrent.FutureTask.run(FutureTask.java:137)
                                                    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1076)
                                                    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:569)
                                                    at java.lang.Thread.run(Thread.java:856)
                                                    at com.bumptech.glide.load.engine.executor.FifoPriorityThreadPoolExecutor$a$1.run(Paramount:118)
                                                 Caused by: javax.net.ssl.SSLProtocolException: SSL handshake aborted: ssl=0x610df808: Failure in SSL library, usually a protocol error
                                                error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure (external/openssl/ssl/s23_clnt.c:741 0x410f976a:0x00000000)
                                                    at org.apache.harmony.xnet.provider.jsse.NativeCrypto.SSL_do_handshake(Native Method)
                                                    at org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:371)
                                                        ... 35 more

由于集成的 SSL 库版本不同，不同 Android 版本的默认 SSL/TLS 版本配置如下表：

Protocol	Supported (API Levels)	Enabled by default (API Levels)
SSLv3	1–TBD	1–22
TLSv1	1+	1+
TLSv1.1	20+	20+
TLSv1.2	20+	20+

在 Android 5.0 之前，最高支持的 SSL/TLS 版本为 TLSv1，而这个版本实际上是一个安全性并不是太好的版本，当前已经有许多网站配置为不再支持这种老版本的 SSL/TLS 。在用 Android 5.0 之前的设备，访问一些不再支持 TLSv1 及之前 SSL/TLS 版本的网站的时候，就会出现一些问题。

在 Android 4.3、Android 4.2.2 和 Android 4.1.1 上，用相同版本的 OkHttp 访问前面配置为最低支持 TLSv1.1 的 HTTP 服务器时，抛出了完全相同的异常。

客户端版本低于服务器支持的最低 SSL/TLS 版本时，HTTPS 连接会在握手阶段失败。

为请求的网络客户端设置一个特殊的SSLSocketFactory

import android.os.Build
import android.util.Log
import com.android.core.Arrays
import com.qihoo.mm.paramount.env.AppEnv
import okhttp3.OkHttpClient
import java.io.IOException
import java.net.InetAddress
import java.net.Socket
import java.net.UnknownHostException
import java.security.GeneralSecurityException
import java.security.KeyStore
import javax.net.ssl.*
public class Tls12SocketFactory extends SSLSocketFactory {
    private static final String[] TLS_SUPPORT_VERSION = {"TLSv1.1", "TLSv1.2"};

    final SSLSocketFactory delegate;

    public Tls12SocketFactory(SSLSocketFactory base) {
        this.delegate = base;
    }

    @Override
    public String[] getDefaultCipherSuites() {
        return delegate.getDefaultCipherSuites();
    }

    @Override
    public String[] getSupportedCipherSuites() {
        return delegate.getSupportedCipherSuites();
    }

    @Override
    public Socket createSocket(Socket s, String host, int port, boolean autoClose) throws IOException {
        return patch(delegate.createSocket(s, host, port, autoClose));
    }

    @Override
    public Socket createSocket(String host, int port) throws IOException, UnknownHostException {
        return patch(delegate.createSocket(host, port));
    }

    @Override
    public Socket createSocket(String host, int port, InetAddress localHost, int localPort) throws IOException, UnknownHostException {
        return patch(delegate.createSocket(host, port, localHost, localPort));
    }

    @Override
    public Socket createSocket(InetAddress host, int port) throws IOException {
        return patch(delegate.createSocket(host, port));
    }

    @Override
    public Socket createSocket(InetAddress address, int port, InetAddress localAddress, int localPort) throws IOException {
        return patch(delegate.createSocket(address, port, localAddress, localPort));
    }

    private Socket patch(Socket s) {
        if (s instanceof SSLSocket) {
            ((SSLSocket) s).setEnabledProtocols(TLS_SUPPORT_VERSION);
        }
        return s;
    }
}

修改默认X509TrustManager

 private X509TrustManager getDefaultTrustManager() {
    try {
      TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(
              TrustManagerFactory.getDefaultAlgorithm());
      trustManagerFactory.init((KeyStore) null);
      TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
      if (trustManagers.length != 1 || !(trustManagers[0] instanceof X509TrustManager)) {
        throw new IllegalStateException("Unexpected default trust managers:"
                + Arrays.toString(trustManagers));
      }
      return (X509TrustManager) trustManagers[0];
    } catch (GeneralSecurityException e) {
      throw new AssertionError(); // The system has no TLS. Just give up.
    }
  }

设置OkHttpClient

 private OkHttpClient initOkHttpClient()  {
        OkHttpClient builder = OkHttpClient.Builder()
        try {
            if(DEBUG){
                Log.i(TAG,"initOkHttpClient")
            }
            if (Build.VERSION.SDK_INT < Build.VERSION_CODES.LOLLIPOP) {
                Tls12SocketFactory.enableTls12OnPreLollipop(builder)
            }
            builder.readTimeout(10L, TimeUnit.SECONDS)//设置读取超时时间
            builder.writeTimeout(10L, TimeUnit.SECONDS)//设置写的超时时间
            builder.connectTimeout(10L, TimeUnit.SECONDS)//设置连接超时时间
        } catch (e: Exception) {
            if(DEBUG){
                Log.e(TAG,"",e)
            }
        }
        return builder.build()
    }

    public static OkHttpClient.Builder enableTls12OnPreLollipop(OkHttpClient.Builder client) {
        if (Build.VERSION.SDK_INT >= 16 && Build.VERSION.SDK_INT < 22) {

              try {
                   val sslContext  = SSLContext.getInstance("TLS")
                    sslContext .init(null, null, null)

                    val socketFactory = Tls12SocketFactory(sslContext.socketFactory)
                    client.sslSocketFactory(socketFactory, getDefaultTrustManager())

                } catch (exc: Exception) {
                    if (AppEnv.bAppdebug) {
                        Log.e("OkHttpTLSCompat", "Error while setting TLS 1.2", exc)
                    }
            try {
                SSLContext sc = SSLContext.getInstance("TLSv1.2");
                sc.init(null, null, null);
                client.sslSocketFactory(new Tls12SocketFactory(sc.getSocketFactory()));
               client.sslSocketFactory(socketFactory, getDefaultTrustManager())

                client.connectionSpecs(specs);
            } catch (Exception exc) {
                if (AppEnv.bAppdebug) {
                    Log.e("OkHttpTLSCompat", "Error while setting TLS 1.2", exc);
                }
            }
        }

        return client;
    }