wss access from PC to Java-WebSocket on Android

[sowd]

Hi,

I'm trying to build an Android wss server with Java-WebSocket and
access it from PC browsers (currently trying Chrome(25.0.1364.172)
and Firefox(19.0.2).)

Unfortunately, I have not been successful in doing this, obtaining
browser-dependent errors when connecting websocket from browsers.

myapp.bks file exists in the application resource folder.

Do you have any ideas to fix these problems?

Thank you in advance,

Shigeru

=====Android source code=====
public class SecureWebSocketServer extends WebSocketServer {

public void start() {
    if (bIsRunning)
        return;
    WebSocketImpl.DEBUG = true;

    if (!bSecureMode) {
        super.start();
        bIsRunning = true;
        return;
    }

    try {


        InputStream is = mContext.getResources().openRawResource(
                com.example.MyApp.R.raw.myapp);
        KeyStore ks = KeyStore.getInstance("BKS");
        ks.load(is, "secret".toCharArray());
        is.close();

        KeyManagerFactory kmf = KeyManagerFactory.getInstance( KeyManagerFactory.getDefaultAlgorithm());
        Log.v(TAG, "KMF:"+KeyManagerFactory.getDefaultAlgorithm());
        kmf.init( ks, "secret".toCharArray() );

        TrustManagerFactory tmf = TrustManagerFactory.getInstance( TrustManagerFactory.getDefaultAlgorithm() );
        Log.v(TAG, "TMF:"+TrustManagerFactory.getDefaultAlgorithm());

        tmf.init( ks );
        SSLContext sslContext = null;
        sslContext = SSLContext.getInstance("TLS");
        sslContext.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);

        setWebSocketFactory(new DefaultSSLWebSocketServerFactory(sslContext));

        super.start();
        bIsRunning = true;
    } catch (KeyStoreException e) {e.printStackTrace();}
      catch (NoSuchAlgorithmException e) {e.printStackTrace();}
      catch (CertificateException e) {e.printStackTrace();}
      catch (FileNotFoundException e) {e.printStackTrace();}
      catch (IOException e) {e.printStackTrace();}
      catch (UnrecoverableKeyException e) { e.printStackTrace();}
      catch (KeyManagementException e) {e.printStackTrace();}
}

}

=====Chrome errors in Android console=====
03-25 16:51:54.594: W/System.err(31460): javax.net.ssl.SSLException: Error occured in delegated task:javax.net.ssl.SSLHandshakeException: PROTOCOL VERSION. Unsupported client version 32
03-25 16:51:54.594: W/System.err(31460): at org.apache.harmony.xnet.provider.jsse.HandshakeProtocol.fatalAlert(HandshakeProtocol.java:319)
03-25 16:51:54.604: W/System.err(31460): at org.apache.harmony.xnet.provider.jsse.HandshakeProtocol.wrap(HandshakeProtocol.java:271)
03-25 16:51:54.604: W/System.err(31460): at org.apache.harmony.xnet.provider.jsse.SSLEngineImpl.wrap(SSLEngineImpl.java:694)
03-25 16:51:54.604: W/System.err(31460): at javax.net.ssl.SSLEngine.wrap(SSLEngine.java:462)
03-25 16:51:54.604: W/System.err(31460): at com.example.MyApp.java_websocket.SSLSocketChannel2.wrap(SSLSocketChannel2.java:141)
03-25 16:51:54.604: W/System.err(31460): at com.example.MyApp.java_websocket.SSLSocketChannel2.processHandshake(SSLSocketChannel2.java:132)
03-25 16:51:54.614: W/System.err(31460): at com.example.MyApp.java_websocket.SSLSocketChannel2.write(SSLSocketChannel2.java:192)
03-25 16:51:54.614: W/System.err(31460): at com.example.MyApp.java_websocket.SSLSocketChannel2.writeMore(SSLSocketChannel2.java:311)
03-25 16:51:54.614: W/System.err(31460): at com.example.MyApp.java_websocket.SocketChannelIOHelper.batch(SocketChannelIOHelper.java:47)
03-25 16:51:54.614: W/System.err(31460): at com.example.MyApp.java_websocket.server.WebSocketServer.run(WebSocketServer.java:349)
03-25 16:51:54.614: W/System.err(31460): at java.lang.Thread.run(Thread.java:856)
03-25 16:51:54.614: W/System.err(31460): Caused by: org.apache.harmony.xnet.provider.jsse.AlertException: javax.net.ssl.SSLHandshakeException: PROTOCOL VERSION. Unsupported client version 32
03-25 16:51:54.624: W/System.err(31460): at org.apache.harmony.xnet.provider.jsse.HandshakeProtocol.fatalAlert(HandshakeProtocol.java:308)
03-25 16:51:54.624: W/System.err(31460): at org.apache.harmony.xnet.provider.jsse.ServerHandshakeImpl.processClientHello(ServerHandshakeImpl.java:334)
03-25 16:51:54.624: W/System.err(31460): at org.apache.harmony.xnet.provider.jsse.ServerHandshakeImpl$1.run(ServerHandshakeImpl.java:124)
03-25 16:51:54.624: W/System.err(31460): at org.apache.harmony.xnet.provider.jsse.DelegatedTask.run(DelegatedTask.java:36)
03-25 16:51:54.624: W/System.err(31460): at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:442)
03-25 16:51:54.624: W/System.err(31460): at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:305)
03-25 16:51:54.634: W/System.err(31460): at java.util.concurrent.FutureTask.run(FutureTask.java:137)
03-25 16:51:54.634: W/System.err(31460): at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:150)
03-25 16:51:54.634: W/System.err(31460): at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:264)
03-25 16:51:54.634: W/System.err(31460): at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1076)
03-25 16:51:54.634: W/System.err(31460): at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:569)
03-25 16:51:54.634: W/System.err(31460): ... 1 more
03-25 16:51:54.644: W/System.err(31460): Caused by: javax.net.ssl.SSLHandshakeException: PROTOCOL VERSION. Unsupported client version 32
03-25 16:51:54.644: W/System.err(31460): ... 12 more

=====Firefox errors in Android console=====

03-25 16:51:33.421: W/System.err(31460): javax.net.ssl.SSLException: Error occured in delegated task:javax.net.ssl.SSLHandshakeException: NO SERVER CERTIFICATE FOUND
03-25 16:51:33.421: W/System.err(31460): at org.apache.harmony.xnet.provider.jsse.HandshakeProtocol.fatalAlert(HandshakeProtocol.java:319)
03-25 16:51:33.421: W/System.err(31460): at org.apache.harmony.xnet.provider.jsse.HandshakeProtocol.wrap(HandshakeProtocol.java:271)
03-25 16:51:33.421: W/System.err(31460): at org.apache.harmony.xnet.provider.jsse.SSLEngineImpl.wrap(SSLEngineImpl.java:694)
03-25 16:51:33.431: W/System.err(31460): at javax.net.ssl.SSLEngine.wrap(SSLEngine.java:462)
03-25 16:51:33.431: W/System.err(31460): at com.example.MyApp.java_websocket.SSLSocketChannel2.wrap(SSLSocketChannel2.java:141)
03-25 16:51:33.431: W/System.err(31460): at com.example.MyApp.java_websocket.SSLSocketChannel2.processHandshake(SSLSocketChannel2.java:132)
03-25 16:51:33.431: W/System.err(31460): at com.example.MyApp.java_websocket.SSLSocketChannel2.write(SSLSocketChannel2.java:192)
03-25 16:51:33.431: W/System.err(31460): at com.example.MyApp.java_websocket.SSLSocketChannel2.writeMore(SSLSocketChannel2.java:311)
03-25 16:51:33.431: W/System.err(31460): at com.example.MyApp.java_websocket.SocketChannelIOHelper.batch(SocketChannelIOHelper.java:47)
03-25 16:51:33.441: W/System.err(31460): at com.example.MyApp.java_websocket.server.WebSocketServer.run(WebSocketServer.java:349)
03-25 16:51:33.441: W/System.err(31460): at java.lang.Thread.run(Thread.java:856)
03-25 16:51:33.441: W/System.err(31460): Caused by: org.apache.harmony.xnet.provider.jsse.AlertException: javax.net.ssl.SSLHandshakeException: NO SERVER CERTIFICATE FOUND
03-25 16:51:33.441: W/System.err(31460): at org.apache.harmony.xnet.provider.jsse.HandshakeProtocol.fatalAlert(HandshakeProtocol.java:308)
03-25 16:51:33.441: W/System.err(31460): at org.apache.harmony.xnet.provider.jsse.ServerHandshakeImpl.processClientHello(ServerHandshakeImpl.java:452)
03-25 16:51:33.451: W/System.err(31460): at org.apache.harmony.xnet.provider.jsse.ServerHandshakeImpl$1.run(ServerHandshakeImpl.java:124)
03-25 16:51:33.451: W/System.err(31460): at org.apache.harmony.xnet.provider.jsse.DelegatedTask.run(DelegatedTask.java:36)
03-25 16:51:33.451: W/System.err(31460): at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:442)
03-25 16:51:33.451: W/System.err(31460): at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:305)
03-25 16:51:33.451: W/System.err(31460): at java.util.concurrent.FutureTask.run(FutureTask.java:137)
03-25 16:51:33.451: W/System.err(31460): at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:150)
03-25 16:51:33.461: W/System.err(31460): at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:264)
03-25 16:51:33.461: W/System.err(31460): at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1076)
03-25 16:51:33.461: W/System.err(31460): at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:569)
03-25 16:51:33.461: W/System.err(31460): ... 1 more
03-25 16:51:33.461: W/System.err(31460): Caused by: javax.net.ssl.SSLHandshakeException: NO SERVER CERTIFICATE FOUND
03-25 16:51:33.461: W/System.err(31460): ... 12 more
03-25 16:51:33.511: W/System.err(31460): javax.net.ssl.SSLException: Error occured in delegated task:javax.net.ssl.SSLHandshakeException: NO SERVER CERTIFICATE FOUND

[Davidiusdadi]

Unfortunately i have no experience with the bouncy castle provider which for some reason has to be used on android. However an other user of this lib told me that he got his wss server woking this way:

package javaapplication1;

import java.io.File;
import java.io.FileInputStream;
import java.security.KeyStore;
import java.security.Security;

import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManagerFactory;
import org.bouncycastle.jce.provider.BouncyCastleProvider;

import org.java_websocket.WebSocketImpl;
import org.java_websocket.server.DefaultSSLWebSocketServerFactory;

public class JavaApplication1 {

    /*
     * Keystore with certificate created like so (in JKS format):
     *
     *keytool -genkey -validity 3650 -keystore "keystore.jks" -storepass "storepassword" -keypass "keypassword" -alias "default" -dname "CN=127.0.0.1, OU=MyOrgUnit, O=MyOrg, L=MyCity, S=MyRegion, C=MyCountry"
     */
    public static void main(String[] args) throws Exception {
        WebSocketImpl.DEBUG = false;

        SSLServer_ chatserver = new SSLServer_(8887); // Firefox does allow multible ssl connection only via port 443 //tested on FF16

        /*-- http://www.bouncycastle.org/specifications.html#install  */
        Security.addProvider(new BouncyCastleProvider());
        // load up the key store
        String STORETYPE = "BKS";
        String KEYSTORE = "d:\\mybks.bks";
        String STOREPASSWORD = "xxx";
        String KEYPASSWORD = "xxx";

        KeyStore ks = KeyStore.getInstance(STORETYPE,"BC");
        File kf = new File(KEYSTORE);
        ks.load(new FileInputStream(kf), STOREPASSWORD.toCharArray());

        KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509");
        kmf.init(ks, KEYPASSWORD.toCharArray());
        TrustManagerFactory tmf = TrustManagerFactory.getInstance("SunX509");
        tmf.init(ks);

        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);

        chatserver.setWebSocketFactory(new DefaultSSLWebSocketServerFactory(sslContext));

        chatserver.start();

    }
}

I would like to know how you generated the bks file?

[sowd]

Hi,

Thank you Davidiusdadi!

Following your friend's code, I could somehow setup a wss server. It works fine for Firefox, IE
and Safari. One exception is Chrome Ver. 25.0.1364.172 m.
It produces protocol version error as I pasted at the end of this post.
Maybe caused by poor TLS support of Android SSL library (<OS Ver 4.1)?

Further comments are appriciated!

Shigeru

Btw, I produce BKS file as follows:

keytool -genkey -v -keyalg RSA -sigalg SHA1withRSA -keystore key.bks -provider org.bouncycastle.jce.provider.BouncyCastleProvider -storetype BKS -providerpath bcprov-jdk16-146.jar -alias devkey -validity 100000

===== Error message on Android on access by Chrome 25.0.1364.172 m =====

03-27 10:48:57.912: W/System.err(6602): javax.net.ssl.SSLException: Error occured in delegated task:javax.net.ssl.SSLHandshakeException: PROTOCOL VERSION. Unsupported client version 32
03-27 10:48:57.922: W/System.err(6602): at org.apache.harmony.xnet.provider.jsse.HandshakeProtocol.fatalAlert(HandshakeProtocol.java:319)
03-27 10:48:57.922: W/System.err(6602): at org.apache.harmony.xnet.provider.jsse.HandshakeProtocol.wrap(HandshakeProtocol.java:271)
03-27 10:48:57.922: W/System.err(6602): at org.apache.harmony.xnet.provider.jsse.SSLEngineImpl.wrap(SSLEngineImpl.java:694)
03-27 10:48:57.922: W/System.err(6602): at javax.net.ssl.SSLEngine.wrap(SSLEngine.java:462)
03-27 10:48:57.922: W/System.err(6602): at com.sonycsl.Kadecot.java_websocket.SSLSocketChannel2.wrap(SSLSocketChannel2.java:141)
03-27 10:48:57.922: W/System.err(6602): at com.sonycsl.Kadecot.java_websocket.SSLSocketChannel2.processHandshake(SSLSocketChannel2.java:132)
03-27 10:48:57.922: W/System.err(6602): at com.sonycsl.Kadecot.java_websocket.SSLSocketChannel2.write(SSLSocketChannel2.java:192)
03-27 10:48:57.922: W/System.err(6602): at com.sonycsl.Kadecot.java_websocket.SSLSocketChannel2.writeMore(SSLSocketChannel2.java:311)
03-27 10:48:57.922: W/System.err(6602): at com.sonycsl.Kadecot.java_websocket.SocketChannelIOHelper.batch(SocketChannelIOHelper.java:47)
03-27 10:48:57.922: W/System.err(6602): at com.sonycsl.Kadecot.java_websocket.server.WebSocketServer.run(WebSocketServer.java:349)
03-27 10:48:57.922: W/System.err(6602): at java.lang.Thread.run(Thread.java:856)
03-27 10:48:57.922: W/System.err(6602): Caused by: org.apache.harmony.xnet.provider.jsse.AlertException: javax.net.ssl.SSLHandshakeException: PROTOCOL VERSION. Unsupported client version 32
03-27 10:48:57.922: W/System.err(6602): at org.apache.harmony.xnet.provider.jsse.HandshakeProtocol.fatalAlert(HandshakeProtocol.java:308)
03-27 10:48:57.922: W/System.err(6602): at org.apache.harmony.xnet.provider.jsse.ServerHandshakeImpl.processClientHello(ServerHandshakeImpl.java:334)
03-27 10:48:57.922: W/System.err(6602): at org.apache.harmony.xnet.provider.jsse.ServerHandshakeImpl$1.run(ServerHandshakeImpl.java:124)
03-27 10:48:57.922: W/System.err(6602): at org.apache.harmony.xnet.provider.jsse.DelegatedTask.run(DelegatedTask.java:36)
03-27 10:48:57.922: W/System.err(6602): at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:442)
03-27 10:48:57.922: W/System.err(6602): at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:305)
03-27 10:48:57.922: W/System.err(6602): at java.util.concurrent.FutureTask.run(FutureTask.java:137)
03-27 10:48:57.922: W/System.err(6602): at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:150)
03-27 10:48:57.922: W/System.err(6602): at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:264)
03-27 10:48:57.922: W/System.err(6602): at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1076)
03-27 10:48:57.922: W/System.err(6602): at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:569)
03-27 10:48:57.922: W/System.err(6602): ... 1 more
03-27 10:48:57.922: W/System.err(6602): Caused by: javax.net.ssl.SSLHandshakeException: PROTOCOL VERSION. Unsupported client version 32
03-27 10:48:57.922: W/System.err(6602): ... 12 more

[Davidiusdadi]

Unfortunately i have no explanation for this at hand. The older android versions appear to have buggy ssl implementation: e.g. #155
I will update this thread as soon as i know more also it will take a while until have time to try out ssl on android myself.
If you find an explenation/solution please let us know.

[sowd]

Hi,
I haven't reached any solution yet. However, as you may know, Android 4.0 or lower
seems only to support TLS 1.0. Here is a reference:

http://stackoverflow.com/questions/5950178/implementing-tls-1-2-on-android-2-3-3

On the other hand, Android 4.1 (unofficially) and Android 4.2 (officially) support TLS 1.2:
http://source.android.com/tech/security/android_4_2_security_enhancements.html

I also found on the web many people struggle to compile openssl for android.

mmm...

sowd

[zjbpku]

was the problem solved?

[sowd]

sorry.i have no solution yet. actually, we decided not to take too much time working on this issue. we can wait until higher version android become common.

thank you very much for your advices.
anyway we will continue to use this cool library for other purposes.

[ani-bellurbis]

@Davidiusdadi @sowd have you got any solution for this issue ?

I have also build web socket server on android platform using selfsigned .bks file, I am able to connect it using my another android/Java client by adding same .bks certificate with client.
But I am unable to connect android web socket server using wss with HTML web page .

[Kushi171987]

@sowd , We have the same problem but my side even not able to connect 'ws websocket server' in android from PC browser client. It seems to you have the problem with 'wss' not the 'ws'. Can you please pls help me if it works for you with just ws server.?

Thanks.

[marci4]

Hello everyone,

is this still an issue for you with the latest version?

Greetings
marci4

[sowd]

Thank you!
I'll find time to check it later.