如何在Android中使用TLS 1.0连接仅支持该协议的设备？

你的代码抛出UNSUPPORTED_PROTOCOL异常，本质是Android 6.0（API 23）及以上版本默认禁用了TLS 1.0/1.1，即使显式创建TLSv1的SSLContext，系统底层加密库仍会拒绝使用这些老旧协议。以下是可行的解决方法：

方法一：配置应用网络安全配置（API 24+适用） #

在res/xml目录下创建network_security_config.xml文件，内容如下：

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <domain-config cleartextTrafficPermitted="false">
        <!-- 替换为你的设备IP或域名 -->
        <domain includeSubdomains="true">192.168.1.10</domain>
        <trust-anchors>
            <certificates src="system" />
            <!-- 若设备用自签名证书，需添加此行并指向你的证书文件 -->
            <!-- <certificates src="@raw/device_cert" /> -->
        </trust-anchors>
        <ssl-config>
            <!-- 允许使用TLS 1.0 -->
            <min-tls-version>TLSv1.0</min-tls-version>
        </ssl-config>
    </domain-config>
</network-security-config>

接着在AndroidManifest.xml的application标签中添加引用：

<application
    ...
    android:networkSecurityConfig="@xml/network_security_config">
    ...
</application>

方法二：自定义SSLSocketFactory强制启用TLS 1.0（兼容低版本） #

若需兼容API 23及以下，或网络安全配置不生效，可通过自定义SSLSocketFactory手动启用TLS 1.0：

import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSocket;
import javax.net.ssl.SSLSocketFactory;
import java.io.IOException;
import java.net.InetAddress;
import java.net.Socket;

public class TLSSocketFactory extends SSLSocketFactory {
    private final SSLSocketFactory delegate;

    public TLSSocketFactory() {
        try {
            SSLContext sslContext = SSLContext.getInstance("TLSv1");
            sslContext.init(null, null, null);
            delegate = sslContext.getSocketFactory();
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }

    @Override
    public String[] getDefaultCipherSuites() {
        return delegate.getDefaultCipherSuites();
    }

    @Override
    public String[] getSupportedCipherSuites() {
        return delegate.getSupportedCipherSuites();
    }

    @Override
    public Socket createSocket(Socket s, String host, int port, boolean autoClose) throws IOException {
        return enableTLSOnSocket(delegate.createSocket(s, host, port, autoClose));
    }

    @Override
    public Socket createSocket(String host, int port) throws IOException {
        return enableTLSOnSocket(delegate.createSocket(host, port));
    }

    @Override
    public Socket createSocket(String host, int port, InetAddress localHost, int localPort) throws IOException {
        return enableTLSOnSocket(delegate.createSocket(host, port, localHost, localPort));
    }

    @Override
    public Socket createSocket(InetAddress host, int port) throws IOException {
        return enableTLSOnSocket(delegate.createSocket(host, port));
    }

    @Override
    public Socket createSocket(InetAddress address, int port, InetAddress localAddress, int localPort) throws IOException {
        return enableTLSOnSocket(delegate.createSocket(address, port, localAddress, localPort));
    }

    private Socket enableTLSOnSocket(Socket socket) {
        if (socket instanceof SSLSocket) {
            ((SSLSocket) socket).setEnabledProtocols(new String[]{"TLSv1"});
        }
        return socket;
    }
}

替换原代码中的SSLSocketFactory创建逻辑：

// 替换原SSLContext.getInstance相关代码
SSLSocketFactory sslSocketFactory = new TLSSocketFactory();

注意事项 #

• 若设备使用自签名证书，需额外配置信任该证书，否则会弹出证书验证失败异常。可通过网络安全配置添加证书，或自定义X509TrustManager跳过验证（仅测试环境使用，生产环境不建议）。
• TLS 1.0存在严重安全漏洞，仅在设备无法升级固件的前提下使用，后续应优先推动设备固件更新。

内容的提问来源于stack exchange，提问作者Hyndrix