SSL handshake aborted: Failure in SSL library

[tobrun]

A user reported seeing:

07-18 13:54:54.006 3071-3071/com.mapbox.mapboxsdk.testapp E/mbgl: {pboxsdk.testapp}[Style]: Failed to load tile 0/0/0=>0 for source tileset-id: javax.net.ssl.SSLProtocolException: SSL handshake aborted: ssl=0x7aecb620: Failure in SSL library, usually a protocol error
error:1407742E:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert protocol version (external/openssl/ssl/s23_clnt.c:741 0x731e7d5c:0x00000000)

When connecting to an external vector source as shown in our examples here. This issue only seems pre nougat devices. Been researching this a bit, and I think the following could resole it:

I found the solution for it by analyzing the data packets using wireshark. What I found is that while making a secure connection, android was falling back to SSLv3 from TLSv1 . It is a bug in android versions <= 4.4 , and it can be solved by removing the SSLv3 protocol from Enabled Protocols list.

I'm going to take proposed workaround in link above for a spin and see if it resolves the error in first section.

[tobrun]

Looked into the proposed workaround from OP, doesn't seem to fix the issue. Since we only have heard about one occurrence specific to these vector tiles. Don't think this actionable for us right now.

[davidpronk]

For reasons beyond my influence we use our own tile server which only supports TLS 1.2
Therefore Android clients running api 19 and below are unable to load vector tiles. Would it be possible for Mapbox to add the workaround as mentioned at https://blog.dev-area.net/2015/08/13/android-4-1-enable-tls-1-1-and-tls-1-2/

[tobrun]

@davidpronk thank you for the ping on this. Have you tried out the linked code and does it resolve your issue?

[davidpronk]

@tobrun I ran into this while working on a NativeScript app using the nativescript-mapbox plugin. So I am unable to apply the workaround in our setup.
The reason we use the plugin is to avoid implementing Mapbox ourselves.

[tobrun]

I'm going to reopen this issue so we can look into the differences between the setup linked in #9640 (comment) versus #9640 (comment).

[tobrun]

With #10948 we are allowing to change OkHttpClient used, this allows to implement workarounds as mentioned above.