集成freeRASP库后出现KeyStoreException及SSL握手失败问题

问题概述 #

集成freeRASP Android（版本8.3.0/9.0.0）后，应用调用安全接口时出现Retrofit/OkHttp抛出的SSLHandshakeException或KeyStoreException，导致API调用失败。移除freeRASP库后，接口调用恢复正常。问题覆盖Android 10至14的多品牌设备（三星、Pixel、华为、一加、Fairphone）。

关键报错信息 #

SSL握手异常 #

javax.net.ssl.SSLHandshakeException: Read error: ssl=0xb400007aa9f06888: Failure in SSL library, usually a protocol error
error:04000044:RSA routines:OPENSSL_internal:internal error (external/conscrypt/common/src/jni/main/cpp/conscrypt/native_crypto.cc:732 0x7aa3ed3791:0x00000000)

KeyStore密钥用途不兼容异常 #

Preferred provider doesn't support key:
    java.security.InvalidKeyException: Keystore operation failed
    at android.security.keystore2.KeyStoreCryptoOperationUtils.getInvalidKeyException(KeyStoreCryptoOperationUtils.java:128)
    ...
Caused by: android.security.KeyStoreException: Incompatible purpose (internal Keystore code: -3 message: system/security/keystore2/src/security_level.rs:310
Caused by:
    0: system/security/keystore2/src/enforcements.rs:563: the purpose is not authorized.
    1: Error::Km(r#INCOMPATIBLE_PURPOSE)) (public error code: 13 internal Keystore code: -3)
    ...
Could not find provider for algorithm: RSA/ECB/NoPadding

环境配置 #

• 应用配置：minSdk 26，targetSdk 34
• 依赖库：Retrofit 2.10.0、OkHttp 4.12.0、Moshi 1.15.1、Koin 3.5.3、BouncyCastle
• 已启用ProGuard，自定义OkHttp的sslSocketFactory并配置SSL固定
• 应用采用基于证书的认证机制，登录时创建证书存入KeyStore并通过OkHttp使用

已尝试方案 #

• 在Application中调整安全提供者顺序：Security.insertProviderAt(BouncyCastleProvider(), 1)
• 排除freeRASP中的OkHttp和BouncyCastle依赖：

  implementation (libs.talsecSecurityCommunity) {
      exclude group: 'com.squareup.okhttp3', module: 'okhttp'
      exclude group: 'org.bouncycastle'
  }
  

有效解决方案 #

1. 调整freeRASP初始化时机 #

将freeRASP的初始化逻辑从MainActivity.onCreate()移至Application.onCreate()，且确保在OkHttpClient实例化之前完成初始化。freeRASP会修改系统Security Provider配置，晚于OkHttp初始化会导致两者SSL上下文冲突。

示例：

class MyApp : Application() {
    override fun onCreate() {
        super.onCreate()
        // 先初始化freeRASP
        val securityHelper = SecurityDetectionHelper(this)
        securityHelper.initSecurityDetection(true) { /* 威胁处理逻辑 */ }
        // 再初始化OkHttpClient等网络组件
        initNetworkComponents()
    }
}

2. 确保KeyStore密钥用途匹配 #

创建KeyStore密钥时，明确指定密钥的签名/验证用途，避免因用途不兼容抛出异常。示例代码：

val keyPairGenerator = KeyPairGenerator.getInstance(
    KeyProperties.KEY_ALGORITHM_RSA,
    "AndroidKeyStore"
)
val parameterSpec = KeyGenParameterSpec.Builder(
    "your_key_alias",
    KeyProperties.PURPOSE_SIGN or KeyProperties.PURPOSE_VERIFY
)
    .setDigests(KeyProperties.DIGEST_SHA256)
    .setSignaturePaddings(KeyProperties.SIGNATURE_PADDING_RSA_PKCS1)
    .build()
keyPairGenerator.initialize(parameterSpec)
val keyPair = keyPairGenerator.generateKeyPair()

3. 统一Security Provider配置 #

移除手动插入BouncyCastle的代码，让系统自动选择兼容的Provider。同时在OkHttp配置中，显式使用系统默认SSL上下文：

val sslContext = SSLContext.getInstance("TLS")
sslContext.init(null, null, null) // 使用系统默认TrustManager和KeyManager

val okHttpClient = OkHttpClient.Builder()
    .sslSocketFactory(sslContext.socketFactory, systemDefaultTrustManager())
    .certificatePinner(/* 你的SSL固定配置 */)
    .build()

// 获取系统默认TrustManager
private fun systemDefaultTrustManager(): X509TrustManager {
    val trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm())
    trustManagerFactory.init(null as KeyStore?)
    val trustManagers = trustManagerFactory.trustManagers
    return trustManagers[0] as X509TrustManager
}

4. 添加freeRASP专属ProGuard规则 #

确保ProGuard不会混淆freeRASP的核心类，避免SSL逻辑异常：

-keep class com.aheaditec.talsec_security.** { *; }
-dontwarn com.aheaditec.talsec_security.**

内容的提问来源于stack exchange，提问作者YMonnier