Question on Android Requirements

I have a grpc server written in go which serves through a valid https certificate, and an Android client like the examples but without the usePlaintext(true) part.

The RPC services work fine for Android devices with sdk-version >= 21, but they fail for older devices with this exception:

io.grpc.StatusRuntimeException: UNAVAILABLE: No provided cause
    at io.grpc.Status.asRuntimeException(Status.java:503)
    at io.grpc.stub.ClientCalls.getUnchecked(ClientCalls.java:207)
    at io.grpc.stub.ClientCalls.blockingUnaryCall(ClientCalls.java:140)
    at net.honarnama.nano.AuthServiceGrpc$AuthServiceBlockingStub.createAccount(AuthServiceGrpc.java:290)
    ... app stack
Caused by: javax.net.ssl.SSLHandshakeException: javax.net.ssl.SSLProtocolException: SSL handshake aborted: ssl=0xb8adea90: Failure in SSL library, usually a protocol error
error:140740B5:SSL routines:SSL23_CLIENT_HELLO:no ciphers available (external/openssl/ssl/s23_clnt.c:486 0xac7ba990:0x00000000)
    at com.android.org.conscrypt.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:448)
    at io.grpc.okhttp.OkHttpProtocolNegotiator.negotiate(OkHttpProtocolNegotiator.java:106)
    at io.grpc.okhttp.OkHttpProtocolNegotiator$AndroidNegotiator.negotiate(OkHttpProtocolNegotiator.java:172)
    at io.grpc.okhttp.OkHttpTlsUpgrader.upgrade(OkHttpTlsUpgrader.java:74)
    at io.grpc.okhttp.OkHttpClientTransport$1.run(OkHttpClientTransport.java:345)
    at io.grpc.internal.SerializingExecutor$TaskRunner.run(SerializingExecutor.java:154)
    ... 3 more
Caused by: javax.net.ssl.SSLProtocolException: SSL handshake aborted: ssl=0xb8adea90: Failure in SSL library, usually a protocol error
error:140740B5:SSL routines:SSL23_CLIENT_HELLO:no ciphers available (external/openssl/ssl/s23_clnt.c:486 0xac7ba990:0x00000000)
    at com.android.org.conscrypt.NativeCrypto.SSL_do_handshake(Native Method)
    at com.android.org.conscrypt.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:405)
    ... 8 more

Using this mechanism I was able to perform the rpc call on an older device, but the suitable Google Play Services version isn’t installed on more than half of the devices in my target population. Is there another way to make grpc work on theses devices? Like switching to Netty-based transport? Is there any sample of an android app usig Netty-based transport?

Thanks in advance

[ejona86]

And I should note that we are working on a cronet-based transport (as an alternative to OkHttp, mainly for QUIC support). It would always include its own copy of boringssl, so it would not depend on Google Play Services Security Provider.

[mrthemuradin]

What worked for me to solve this issue on android < 21 - when you are creating channel for SpeechGrpc try to add this line to builder: .connectionSpec(ConnectionSpec.MODERN_TLS), so full code snippet looks like:

final ManagedChannel channel = new OkHttpChannelProvider()
                    .builderForAddress(HOSTNAME, PORT)
                    .connectionSpec(ConnectionSpec.MODERN_TLS)
                    .nameResolverFactory(new DnsNameResolverProvider())
                    .intercept(new GoogleCredentialsInterceptor(new GoogleCredentials(accessToken)
                            .createScoped(SCOPE)))
                    .build();