How to disable SSLv3 for Corona app running on Android

I am testing a Corona App to access my API server.  It seems to work just fine in the Corona Simulator and when built as a Windows app.  I have not tried to build an iOS version yet because I am not that proficient at running a Mac - I like to get Windows and Android working first then dawdle in Mac land until I get it working there.

My app is blowing up when trying to do a network.request(), both GET and POST, to an https://url – but only on some Android devices. It appears to be related to the Andriod version on the device prioritizing SSLv3 over TLS 1.* and my API server has SSLv3 disabled due to SSLv3 security exposures.  Examples of failing systems are my test tablet which is running Android 4.4.3, another test phone (I do not have the version here with me right now) and whatever version of Android is in the current version BlueStacks I just installed yesterday – they all get back an error object with the cause set to

javax.net.ssl.SSLProtocolException: SSL handshake aborted: ssl=0x6363c088: Failure in SSL library, usually a protocol error

error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure (external.openssl/ssl/s23_cInt.c:741 0x5e5b4d74:0x00000000):https://<url here>

By contrast, my test android phone runs Android 5.1 and it is not having this problem – and neither is the Corona Simulator or the Windows build of the app.

Does anyone know if there is a way to tell Corona to tell Android NOT to use SSLv3?  I found some references to how it could be done in a native Android app, including this one ( https://stackoverflow.com/questions/26649389/how-to-disable-sslv3-in-android-for-httpsurlconnection ) which looks like it might contain a complete solution.  I just have no idea how to get this to happen in a Corona app, and I hate to exclude so many earilier verions if there is a way to get Corona to tell Android not to use SSL v3.

Is this something that someone could create a plugin for?  If so, is there anyone out there that would like to create such a plugin?

Any help appreciated!

Thanks

Ken

Basically 4.4.2 doesn’t handle TLS 1.2

You can file a bug and we can see if we can find a solution, but you need to enable SSLv3 if you can as the lowest preference or run everything through the openssl.plugin.

https://github.com/ssllabs/ssllabs-scan/issues/258

Rob

Basically 4.4.2 doesn’t handle TLS 1.2

You can file a bug and we can see if we can find a solution, but you need to enable SSLv3 if you can as the lowest preference or run everything through the openssl.plugin.

https://github.com/ssllabs/ssllabs-scan/issues/258

Rob