java.security.cert.CertificateException

[replicant1]

Hi Pedro,

I recently upgraded from RootEncoder 2.4.5 to 2.5.5. I suddenly found that I can no longer stream RTMP and get the following error in logcat whenever I try:

java.security.cert.CertificateException: Domain specific configurations require that hostname aware checkServerTrusted(X509Certificate[], String, String) is used
at java.lang.reflect.Constructor.newInstance0(Native Method)
at java.lang.reflect.Constructor.newInstance(Constructor.java:343)
at io.ktor.utils.io.ExceptionUtilsJvmKt$createConstructor$$inlined$safeCtor$1.invoke(ExceptionUtilsJvm.kt:103)
at io.ktor.utils.io.ExceptionUtilsJvmKt$createConstructor$$inlined$safeCtor$1.invoke(ExceptionUtilsJvm.kt:90)
at io.ktor.utils.io.ExceptionUtilsJvmKt.tryCopyException(ExceptionUtilsJvm.kt:45)
at io.ktor.utils.io.ByteBufferChannelKt.rethrowClosed(ByteBufferChannel.kt:2404)
at io.ktor.utils.io.ByteBufferChannelKt.access$rethrowClosed(ByteBufferChannel.kt:1)
at io.ktor.utils.io.ByteBufferChannel.setupStateForWrite$ktor_io(ByteBufferChannel.kt:234)
at io.ktor.utils.io.ByteBufferChannel.writeByte$suspendImpl(ByteBufferChannel.kt:2653)
at io.ktor.utils.io.ByteBufferChannel.writeByte(Unknown Source:0)
at io.ktor.network.tls.RenderKt.writeRecord(Render.kt:17)
at io.ktor.network.tls.TLSClientHandshake$output$1.invokeSuspend(TLSClientHandshake.kt:118)
at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33)
at kotlinx.coroutines.DispatchedTask.run(DispatchedTask.kt:101)
at kotlinx.coroutines.scheduling.CoroutineScheduler.runSafely(CoroutineScheduler.kt:589)
at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.executeTask(CoroutineScheduler.kt:832)
at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.runWorker(CoroutineScheduler.kt:720)
at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.run(CoroutineScheduler.kt:707)
                                                                                                    	
Suppressed: kotlinx.coroutines.internal.DiagnosticCoroutineContextException: [CoroutineName(cio-tls-encoder), ActorCoroutine{Cancelling}@a9c0a15, Dispatchers.Default]
Caused by: java.security.cert.CertificateException: Domain specific configurations require that hostname aware checkServerTrusted(X509Certificate[], String, String) is used
at android.security.net.config.RootTrustManager.checkServerTrusted(RootTrustManager.java:113)
at io.ktor.network.tls.TLSClientHandshake.handleCertificatesAndKeys(TLSClientHandshake.kt:235)
at io.ktor.network.tls.TLSClientHandshake.access$handleCertificatesAndKeys(TLSClientHandshake.kt:24)
at io.ktor.network.tls.TLSClientHandshake$handleCertificatesAndKeys$1.invokeSuspend(Unknown Source:14)
at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33)
at kotlinx.coroutines.DispatchedTask.run(DispatchedTask.kt:101)
at kotlinx.coroutines.internal.LimitedDispatcher$Worker.run(LimitedDispatcher.kt:113)
at kotlinx.coroutines.scheduling.TaskImpl.run(Tasks.kt:89)
at kotlinx.coroutines.scheduling.CoroutineScheduler.runSafely(CoroutineScheduler.kt:589)
at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.executeTask(CoroutineScheduler.kt:823)
... 2 more

Have you got any idea what might've changed between 2.4.5 and 2.5.5 that could've caused this? A little googling suggests that very old versions of ktor used to have this problem:

Link

But I think you're using ktor 2.3.13, so this probably doesn't apply?

Is there anything I can do from my own code to work around it? At the moment I'm calling RtmpCamera1.startStream("rtmps://redacted_url.com:8443/show/redacted_key") and the error above shortly follows.

I would be most grateful for any suggestions you can offer.

Thanks,

Rod Bailey

BTW: The bug first appears in 2.5.2 where the release notes say "Replace java.io sockets to ktor sockets". 2.5.1 works fine.

[pedroSG94]

Hello,

The problem is related with TLS certificates. You can try this:

  class AcceptAllCertificates: X509TrustManager {
    override fun checkClientTrusted(chain: Array<out X509Certificate>?, authType: String?) {}
    override fun checkServerTrusted(chain: Array<out X509Certificate>?, authType: String?) {}
    override fun getAcceptedIssuers(): Array<X509Certificate>? = null
  }
//set certificate to the stream
getStreamClient().addCertificates(AcceptAllCertificates())

Ideally you should create and set your own certificate instead of skip all certificates.

[replicant1]

Hi Pedro - thanks for your prompt response. I'll try what you've suggested and let you know how I go.
Thanks!
Rod.

[replicant1]

Hi Pedro,

Your code worked perfectly for me and now I can stream OK with RootEncoder 2.5.5. Thank you!

If you have the time, I have a couple of further questions on this.

1) Android Studio prompted me with the following warning when I introduced the class AcceptAllCertificates:

Implementing a custom X509TrustManager is error-prone and likely to be insecure. It is likely to disable certificate validation altogether, and is non-trivial to implement correctly without calling Android's default implementation.

In light of this, how would you recommend I go about implementing my own X509TrustManager that authenticates only my own SSL certificate? The Android Studio warning makes it sound like a big task?

2) Prior to Root Encoder 2.5.2, was the certificate being authenticated by Root Encoder in any way, or was it just assumed to be OK?

Thanks for putting up with my questions.

Regards,

Rod.

[pedroSG94]

Hello,

I recommend you create a certificate and set it to the library. Similar to this:
#1395

[replicant1]

Thanks. I will get onto it.

[replicant1]

Hi Pedro,

I think I may have described my situation incorrectly. The approach that you point to above seems to be for self-signed certificates and, if I understand correctly, requires me to store my SSL certificate (as a p12 file) in a key store which is then loaded into the Android app and provided to Root Encoder as a TrustManager.

But in my situation I am not using self-signed certificates. I'm using real SSL certificates provided by "Let's Encrypt". I can't store these SSL certificates in my Android app because the certificates are automatically renewed on a regular basis. Also, everything I can find on p12 files suggests they contain private key info, but surely my Android app should not need a private key in order to stream to the server where the SSL certificate is held?

I am not very good with security stuff so it's very possible I'm simply misunderstanding your directions - can you please clarify how I can get Root Encoder working with my SSL certificates from "Let's Encrypt"?

Thanks again for your patience.

Rod.