Android SSL Fails

[spanky411]

Describe the issue

authResultCognito failed curlCode: 60, SSL peer certificate or SSH remote key was not OK; Details: SSL certificate problem: unable to get local issuer certificate

I'm at my wits end here. If I set clientConfig.caFile = "cacert.pem"; I get a 77 error
I'm sure you're going to refer to the curl/openssl projects, but this is such a basic functionality of the aws SDK that it really should be documented here. I haven't found a functional solution anywhere. I've even tried replacing the curl/openssl libraries with the precompiled library from a specific android curl/openssl port.

Links

https://github.com/openssl/openssl/blob/master/NOTES-ANDROID.md

[DmitriyMusatkin]

curl error 60 indicates that cert presented by the server could not be verified against trust store on your system. what are you trying to connect to? aws service or 3p? if its aws service, my guess would be that its due to outdated trust store on the device.

curl error 77 is due to curl not being able to open trust store file. you would need to provide a full code to do more debugging on this, but if you are just setting cafile to cacert.pem and cacert.pem is not in the same dir as executable i can see how curl would fail on that.

[spanky411]

As best I can tell, its that the openssl version the SDK uses is 1.1.1 (current openssl is up to 3.5). In linux that links to the system openssl, so its clearly compatible with a recent version, but I cant figure out how to get it to use a recent openssl when compiling for android.

I'm running on the simulator, which can get to the AWS endpoint through the browser, so its certs are current. I dont think its a "device" issue.

I'm not so much worried about the 77 error (I'm literally trying anything I can think of), but the 60 error is out of the box (so to speak), which means the SDK does not work in android. I'm sure it does, but its not clear how to get it working.

[DmitriyMusatkin]

version of openssl does not matter here. Each OS ships with a bundle of root certs that are maintained through OS specific mechanisms. When you establish connection to endpoint, client and underlying crypto implementation will verify the cert presented by server against those root certs on the system. error 60 indicates that that verification is failing, which typically is a sign of system root certs either being old or some root ca is missing.

Im not an expert on android, but check if your simulator version is recent enough. Also just running openssl directly to see if it can validate cert in the simulator might help narrow down the issue

[spanky411]

On android, I think it does. This is the best clue I've found:
openssl/openssl#15154

Apologies, but I'm sort of figuring this out as I go. This could be a deadend, but it seems the certs are hashed differently in android (and may have changed at some point) and maybe the older version of openssl doesn't play nice with that?

[DmitriyMusatkin]

Ah it gets more complicated then if openssl cannot parse the format that android provides certs in.
Dont think we can recommend anything other than overriding the certs to a format that openssl does understand

[spanky411]

Shouldn't it just be able to use the system certs. It seems like openssl has solved that problem in more recent versions, but the aws-sdk-cpp build tools insist on using an old version by default.

I've tried to get the SDK to build with external libraries, but that seems impossible on android (the build system is very opaque, so its entirely possible I haven't set something simple). A documented build command that would produce a linkage with a modern openssl (and curl)... for android... would be super helpful.

Overriding to use different certs led me down that 77 error. There's a whole other can of works with android and its horrible file system security.

[DmitriyMusatkin]

SDK is not doing anything too fancy with libcrypto, it links against whatever cmake finds, so typical cmake flags for openssl should work. ex.
-DOPENSSL_ROOT_DIR=/path/to/openssl
-DOPENSSL_LIBRARIES=/path/to/openssl/lib
-DOPENSSL_INCLUDE_DIR=/path/to/openssl/include \

[spanky411]

I had that... Actually specifying the library file itself. This time I looked over the cmake output and got this:

...
[370/372] Building C object crypto/fipsmodule/CMakeFiles/fipsmodule.dir/bcm.c.o
[371/372] Linking C static library crypto/libcrypto.a
[371/372] Install the project...
-- Install configuration: "Release"
-- Installing: /home/spanky/GitRepos/aws-sdk-cpp/build_android/deps/AWSLC/install/include/openssl
-- Installing: /home/spanky/GitRepos/aws-sdk-cpp/build_android/deps/AWSLC/install/include/openssl/bio.h
...

Looking at /home/spanky/GitRepos/aws-sdk-cpp/build_android/deps/AWSLC/install/include/openssl/opensslv.h, its 0x1010107f, which is old

It appears to be finding my curl, so at least I'm doing "something" right
-- Found CURL: /home/spanky/GitRepos/curl/android_libcurl_x86_64/lib/libcurl.a (found version "8.14.0-DEV")
likewise with my libcrypto.a

But I dont see it finding my openssl. Its like its not even looking for it.

I think what I'm looking for is someone to confirm that this even works on android. I'm likely screwing something up, but I've tried this so many different ways that I feel like its just not as simple as the wrong cmake flags. Again, I can get it to compile and run on android, but it just doesn't do the one most basic thing a web based API SDK is supposed to (actually connect via https).

For what its worth, I've got it working on linux, mac, ios, and windows. Why android is being such a pain is a mystery.

[DmitriyMusatkin]

AWSLC is aws fork of boringssl, which is in turn fork of openssl around 1.1.1.

How are you building for android explicitly? Looks like we have a custom script for android builds https://github.com/aws/aws-sdk-cpp/tree/main/tools/android-build that already does some packaging, but im not familiar with it at all. @sbiscigl who might know more about it

[spanky411]

Basically this:

	cmake .. \
		-GNinja \
		-DCMAKE_BUILD_TYPE=Release \
		-DCMAKE_SYSTEM_NAME=Android \
		-DTARGET_ARCH=ANDROID \
		-DNDK_DIR="${ANDROID_NDK}" \
		-DANDROID_NATIVE_API_LEVEL=21 \
		-DANDROID_ABI=${MY_ABI} \
		-DANDROID_BUILD_ZLIB=OFF \
		-DBUILD_SHARED_LIBS=OFF \
		-DENABLE_TESTING=OFF \
		-DAUTORUN_UNIT_TESTS=OFF \
		-DBUILD_ONLY="s3;dynamodb;cognito-identity;cognito-idp" \
		-DCMAKE_INSTALL_PREFIX="~/GitRepos/aws-sdk-cpp/libaws_android/${MY_ABI}"
	cmake --build . --config=Release
	cmake --install . --config=Release

Can anyone confirm that this actually works on android? The above gets me to compile and run the SDK in my app, but its practically useless without the ability to make a connection to the server.

[DmitriyMusatkin]

note that the error you are seeing is coming from curl and the command you are using will just build sdk, which will pick up whatever curl you have on the path. libcrypto that sdk links in this case might not be relevant (it gets tricky when you include multiple different libs that all compiled against different versions of libcrypto, which is why we recommend to use same libcrypto for sdk and for curl, etc...).

Where is curl coming from? is it a specific android version?

[spanky411]

The android tools are pulling that in and compiling it. It compiles curl openssl, and zlib, unless explicitly turned off (although at least with openssl, it insists on building it from 1.1.1g)

Here's the cmake output from the above command:

[700/700] Linking C executable tests/server/fake_ntlm
[15/16] Performing install step for 'CURL'
[0/1] Install the project...
-- Install configuration: "Release"
-- Installing: /home/spanky/GitRepos/aws-sdk-cpp/libaws_android/x86_64/external-install/curl/bin/curl-config
-- Installing: /home/spanky/GitRepos/aws-sdk-cpp/libaws_android/x86_64/external-install/curl/lib/pkgconfig/libcurl.pc
-- Installing: /home/spanky/GitRepos/aws-sdk-cpp/libaws_android/x86_64/external-install/curl/include/curl/curlbuild.h

Its not entirely obvious that its actually compiling it, but it drops the curl repo in the build folder. Also, my system curl is 8.11.0, and the one running on the android simulator (linked in from the external-install folder) is 7.52.1-DEV. See the CMakeLists.txt file in the tools/android_build folder you referenced. The tools are definitely building it.

Again, I'm still trying to determine if even is a library issue. Can someone please, please, please confirm that this sdk works on android. Was this ever actually tested as functional (because it does appear to run fine until you try and actually interact with the server)