TLS v1.2 is not working on KitKat.

If one is trying to use a slightly stricter ConnectionSpec than MODERN_TLS by limiting TLS to only v1.2 then OkHttp doesn’t work on Android KitKat. Even though this version of Android does support TLS v1.2 (https://developer.android.com/reference/javax/net/ssl/SSLSocket.html).

Example:

OkHttpClient will fail to establish connection on KitKat using this spec:

 new ConnectionSpec.Builder(ConnectionSpec.MODERN_TLS)
      .tlsVersions(TlsVersion.TLS_1_2)
      .build();

The underlying problem is that ConnectionSpec is checking if SSLSocket.getEnabledProtocols() contains TLS v1.2 before actually calling setEnabledProtocols() with TLS v1.2. Instead it should check if SSLSocket supports TLS v1.2 and then enable this protocol if so.

It looks like replacing getEnabledProtocols() with getSupportedProtocols() in ConnectionSpec.isCompatible() and ConnectionSpec.supportedSpec() can fix it.

[swankjesse]

Sadly no action for us to take here. TLS 1.2 is disabled by default on KitKat, and our policy is to use only TLS versions that are enabled by default.

[faramund]

Same problem. Here is a solution: http://blog.dev-area.net/2015/08/13/android-4-1-enable-tls-1-1-and-tls-1-2/ This is a hard change, but some payment providers require TLSv1.1 or TLS1.2 now or in next months (PCI-DSS regulations about credit cards), so it is important to enable communications also for 4.4 devices (in theory TLSv1.2 should works also on 4.1).