cordova "release" behaves differently to "debug" regarding SSL

Question

I have very difficult and totally ungoogleable problem with cordova.

A program, working perfectly being compiled in --debug mode, ceases working after compilation in --release mode. I made sure the source is identical, and the effect is constant.

The only difference between --debug build and --release build is that the --release build fails to open any SSL connections.

This problem is localized very narrow, in my case it is the following line:

Socket = new WebSocket('wss://376.su/');

a friend of mine has reported the same error occurrence in the line:

<img src="https://blabla" />;

UPD: the problem is solved see the answers.

Swinson

yes i did. for the sake of brevity i omitted the statement that the very same "--release" program works perfectly without SSL, provided everything else the same. – Swinson

Answer 1

Problem

I have identified the exact source of the problem and i have found the perfect solution. It turned out to be a superposition of two separate issues each of which is seriously misleading:

1. My SSL certificate from Thawte (despite its cost) is not recognized by Android 5.1.1 as a valid one (while being recognized by all desktop browsers)

2. The --debug flag in cordova build simply ignores certificate "errors" (silently).

Solution

Go to your project's directory and find the following file:

platforms/android/CordovaLib/src/org/apache/cordova/engine/SystemWebViewClient.java

Locate the method definition (onReceivedSslError) and the following condition:

(appInfo.flags & ApplicationInfo.FLAG_DEBUGGABLE) != 0

This is what makes --debug and --release different. In order to ignore certificate "errors" the following code should be executed:

handler.proceed();
return;

This file persists through the build process. Don't forget to ignore those quasi-errors next time you add a platform to your project.

Swinson

that condition should be actually ignored and that code should be in any case executed, as you said! This is 6.2.0 of cordova and this technique is still helping! – Ritualist

This gets my release build working but for some reason when the same release.apk is uploaded to play store it fails again? – Plasmodium

This solution is insecure, deploy your certificate properly see #32022243 – Calumniate

This fix worked for me. The release certificate was one generated by Android Studio to sign the release output apk file. When my app issued a SSL XMLHttpRequest to a server, it silently failed for a release build, but worked for a debug build. The certificate for the apk and the certificate for the server are of course not the same. I just want to install a private app using Android Debug Bridge: >adb install MyPrivateApp.apk. – Snailfish

Answer 2

Issue

Android does not recognise the certificate authority (CA) of that certificate. It is a common issue, specially with older devices, and it affects every device every time a new CA appears.

Solutions

A. Configure intermediate certificates.

Look for a detailed setup for your platform. Here are some examples:

• Microsoft IIS and Exchange: https://knowledge.digicert.com/solution/SO16219.html

• Apache on RedHat (and related): https://access.redhat.com/solutions/43575

You can read more about it in this Q&A at StackExchange's Unix.

B. Use the trust hierarchy chaining certs.

Taking advantage of the trust hierarchy feature, you can chain certs.

You can leverage the effort using a tool like: https://whatsmychaincert.com/

Or you can do it by yourself, as it is just a concatenation of text files (certs):

Example steps for Linux / macOS

1. Concat the authority's certs with your cert. That way you'll send your CA's certificates first to ensure that the device trust your CA before your domain's certificate.

   If you have separated certs, this shell command does the trick:

   $ cat authority1.cert authority2.cert authority3.cert your_domain.cert >> your_domain_bundle.cert
   

   Or if you have a ca-bundle file, that is a concatenation of certificates, just run:

   $ cat authority.ca-bundle your_domain.cert >> your_domain_bundle.cert
   

2. Add that your_domain_bundle.cert to the server.

Problem solved for any ssl protocol, https, wss, etc.

Ayr

there is no need in half-solutions in the presence of a better one. ignoring "authority" does not invalidate the purpose of SSL, learn you some math. – Swinson

Could you explain how ignoring the certificate's validity is better than validate the certificate authority? I'd want to understand why I'm wrong. – Ayr

This solution is better than ignoring errors, but a more generic "this is what an intermediate certificate is, here's a resource on installing them on various platforms" might be suitable. There's at least a dozen different ways to set up CA certs for your web server. – Eer

This is the real solution to this issue, if you have this issue symptoms check your SSL certificate is properly deployed with chain and intermediate cert concatenated via: ssllabs.com/ssltest/analyze.html?d=example.com&latest – Calumniate

Answer 3

I had the same problem but the main source isn't the code SystemWebViewClient.java. Your post helped me a lot to find the exact source. Actually the main source is that the https site you are trying to reach is missing the certificate authority (CA) that is needed by Cordova to connect to a secured site. Actually I'm using Siberian CMS which is built over Ionic/Cordova.

You can check the site with https://www.sslshopper.com/ssl-checker.html#hostname=

Metopic

Answer 4

I encountered this issue on Android 5.1.1, and this post helped me solve the problem by debugging the SystemWebViewClient.java class using adb logcat. There are some standard SSL errors as can be seen at: https://developer.android.com/reference/android/net/http/SslError.

In my case, I ended up discovering that the issuing CA (Let's Encrypt) was no longer trusted on Android versions older than 7.

Angulo

Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center. – Kingofarms