SSLHandshake failed with Android 7

I have issues with Android 7, on Samsung A3. When making an SSL request to https://hsracer.com - here is the report from SSL Labs - https://www.ssllabs.com/ssltest/analyze.html?d=hsracer.com&latest We use OkHttp 3.9.0 with default configuration Stacktrace:

com.omisoft.hsracer E/com.omisoft.hsracer.common.loader.BaseServerAction: javax.net.ssl.SSLHandshakeException: Handshake failed
                                                                                                            at `com.android.org.conscrypt.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:444)`
                                                                                                            at okhttp3.internal.connection.RealConnection.connectTls(RealConnection.java:299)
                                                                                                            at okhttp3.internal.connection.RealConnection.establishProtocol(RealConnection.java:268)
                                                                                                            at okhttp3.internal.connection.RealConnection.connect(RealConnection.java:160)

[enriquebautista]

@yschimke Hi! thanks for the response, i update Okhttp 3.14.9 to 4.8.1 but i have same issue. So, in the docs:

`OkHttp uses your platform’s built-in TLS implementation. On Java platforms OkHttp also supports Conscrypt, which integrates BoringSSL with Java. OkHttp will use Conscrypt if it is the first security provider:

Security.insertProviderAt(Conscrypt.newProvider(), 1);`

Library: implementation ‘org.conscrypt:conscrypt-android:2.5.0’

and in Application onCreate: Security.insertProviderAt(Conscrypt.newProvider(), 1);

Works in Android 7 using TLSv1.3!

I want to know if it’s the right thing to do, and if I only apply it to a specific api or to the entire app. My application supports at least api 21.

[didoatanasov]

@yschimke the problem was with the preferred order of the SSL ciphers. The nginx configuration that didn’t work was: #

ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";

And the working one is:]=

 ssl_ciphers "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS";

I used https://www.ssllabs.com/ssltest to analyze the ssl config. Regards, Deyan