收到AWS要求后，如何更新Android AWS SDK使用TLS 1.2连接？

方案一：优先升级AWS SDK for Android版本 #

你的当前SDK版本（2.11.1）过于老旧，AWS在2.22.0及以上版本的AWS SDK for Android中已默认强制使用TLS 1.2，无需额外配置。

1. 修改项目Module级别的build.gradle文件，替换旧的AWS SDK依赖为最新稳定版：

   // 替换核心依赖
   implementation 'com.amazonaws:aws-android-sdk-core:2.62.0'
   // 按需替换对应服务的依赖，比如STS、Cognito等
   implementation 'com.amazonaws:aws-android-sdk-sts:2.62.0'
   implementation 'com.amazonaws:aws-android-sdk-cognitoidentityprovider:2.62.0'
   

2. 同步项目依赖，确保所有AWS相关模块都升级到同一版本，避免兼容性问题。

方案二：手动配置TLS 1.2（无法升级SDK时） #

如果暂时无法升级SDK，可以通过自定义OkHttp客户端强制启用TLS 1.2，再将其绑定到AWS客户端。

自定义TLS 1.2 enabled的OkHttpClient #

import com.amazonaws.http.HttpClient;
import com.amazonaws.http.HttpClientFactory;
import com.amazonaws.http.android.AndroidHttpClientFactory;
import okhttp3.OkHttpClient;
import okhttp3.TlsVersion;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSocketFactory;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;
import java.security.KeyManagementException;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
import java.security.cert.X509Certificate;

// 创建强制使用TLS 1.2的OkHttpClient
private OkHttpClient createTLS12OkHttpClient() {
    try {
        SSLContext sslContext = SSLContext.getInstance("TLSv1.2");
        sslContext.init(null, new TrustManager[]{new X509TrustManager() {
            @Override
            public void checkClientTrusted(X509Certificate[] chain, String authType) {}

            @Override
            public void checkServerTrusted(X509Certificate[] chain, String authType) {}

            @Override
            public X509Certificate[] getAcceptedIssuers() {
                return new X509Certificate[0];
            }
        }}, new SecureRandom());

        SSLSocketFactory sslSocketFactory = sslContext.getSocketFactory();

        return new OkHttpClient.Builder()
                .sslSocketFactory(sslSocketFactory, (X509TrustManager) sslContext.getTrustManagers()[0])
                .protocols(java.util.Collections.singletonList(TlsVersion.TLS_1_2))
                .build();
    } catch (NoSuchAlgorithmException | KeyManagementException e) {
        throw new RuntimeException("Failed to create TLS 1.2 enabled client", e);
    }
}

将自定义客户端绑定到AWS服务实例 #

以STS客户端和Cognito凭证提供者为例：

private void configureAWSWithTLS12() {
    HttpClientFactory factory = new AndroidHttpClientFactory(createTLS12OkHttpClient());
    HttpClient httpClient = factory.createHttpClient();

    // 配置STS客户端
    AmazonSTSClient stsClient = new AmazonSTSClient(new BasicAWSCredentials("YOUR_ACCESS_KEY", "YOUR_SECRET_KEY"));
    stsClient.setHttpClient(httpClient);

    // 配置Cognito凭证提供者
    CognitoCachingCredentialsProvider credentialsProvider = new CognitoCachingCredentialsProvider(
            getApplicationContext(),
            "YOUR_IDENTITY_POOL_ID",
            Regions.US_EAST_1
    );
    credentialsProvider.setHttpClient(httpClient);
}

注意事项 #

• Android版本兼容：Android 4.1-4.4（API 16-19）默认支持TLS 1.2但需手动配置，Android 5.0及以上默认启用，上述代码可覆盖全版本兼容场景。
• 验证修改：完成配置后，可通过AWS CloudTrail日志确认连接的TLS版本已切换为1.2。

内容的提问来源于stack exchange，提问作者hvar