SSL Handshake Failures on Android Device

ionic-v1
1

I recently built an application targeting iOS and Android platforms. It runs well in iPhone and Android desktop emulators, as well as on iOS devices, but when trying to run on an external device (with an older, un-upgradeable Android OS - 4.2.2), I’m not able to connect to the application’s server via SSL to authenticate.

After attaching the device to my machine and debugging via Android Studio, I found that when the $http.post executes at login to our app, logcat shows the following:

[1128/224427:WARNING:http_stream_factory_impl_job.cc(865)] Falling back to SSLv3 because host is TLS intolerant: inflow.grplife.com:443
11-28 22:44:27.799 4449-4470/com.ionicframework.grplifemobile719422 E/chromium: external/chromium/net/socket/ssl_client_socket_openssl.cc:792: [1128/224427:ERROR:ssl_client_socket_openssl.cc(792)] handshake failed; returned -1, SSL error code 1, net_error -107
11-28 22:44:32.299 2265-2265/? E/dhcpcd: invalid IPv6 type or code from fe80::8e04:ffff:fe37:a6a2

It’s clear from this (at least I believe so) that the connection is not allowed due to SSL handshake issues. The certificate for the server is valid, so I’m not sure how to work around this.

For other applications I’ve worked on (not using ionic), we were able to get around this type of thing by making modifications to the TrustManagerFactory - this doesn’t seem to be possible in the ionic case sense the connection is handled using a webview.

Any suggestions on how to resolve this?

Thank you!

2

I was able to resolve the issue on the server side. It turned out that our apache mod_ssl was configured to allow only TLSv1.2 and that the cipher suite was also restrictive. Using https://www.ssllabs.com/ssltest was helpful in analyzing.

Conclusion - we updated the allowed SSL protocols to include TLS v1, 1.1 and 1.2 and added the following cipher suites in this order:

ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5

We’re now able to login to our app using TLS on Android OS’s below 5.0.