[Backport] Support domain specific server authentication

Description

To my complete amazement, we did support domain specific server authentication, in v2.7 and broke it in 2.8.

Conscrypt, the subsystem to which OkHttp delegates for TLS authentication, attempts to call a method with the signature checkServerTrusted (X509Certificate[], String, String), by reflection. In 2.7 we used Android's default trust manager, which did have such a method. In 2.8, to support our new Listener modes, we install our own custom trust manager and proxy most calls to the default. Our custom trust manager, however, does not have the method. Conscrypt falls back to using the default method checkServerTrusted (X509Certificate[], String), which fails if the app has a network-security-config.

I believe that this fix is, simply, to add the missing signature and to proxy it to the default manager.

Activity

Show:

Blake Meike June 16, 2021 at 12:27 AM

Done

Blake Meike June 16, 2021 at 12:24 AM

Done in couchbase-lite-java-ee-root @ a8253e7ca834486faf1a3

Fixed
Pinned fields
Click on the next to a field label to start pinning.

Details

Assignee

Reporter

Story Points

Components

Sprint

Fix versions

Affects versions

Priority

Instabug

Open Instabug

PagerDuty

Sentry

Zendesk Support

Created June 8, 2021 at 8:48 PM
Updated August 11, 2021 at 3:28 PM
Resolved June 16, 2021 at 12:27 AM
Instabug