Android SDK24下如何在最新版OkHttpClient中启用TLS 1.2

嗨，我之前在基于SDK 24的Android项目里刚好处理过相同的需求，最新版OkHttpClient配置TLS 1.2其实没你想的那么复杂，可能是你没找对正确的配置姿势，我把完整的实现步骤和代码示例分享给你：

Android 7.0（SDK 24）本身已经原生支持TLS 1.2，但部分场景下OkHttpClient的默认配置不会强制使用它，所以我们需要自定义连接规格（ConnectionSpec）和SSL上下文，来约束客户端仅使用TLS 1.2进行通信。

Kotlin版本 #

1. 创建TLS 1.2专属的连接配置和SSL上下文 #

import okhttp3.ConnectionSpec
import okhttp3.OkHttpClient
import okhttp3.TlsVersion
import java.security.SSLContext
import java.security.cert.X509Certificate
import javax.net.ssl.X509TrustManager

// 自定义TrustManager（注意：上线环境请替换为证书验证逻辑，不要直接忽略验证）
class X509TrustManagerImpl : X509TrustManager {
    override fun checkClientTrusted(chain: Array<out X509Certificate>?, authType: String?) {}
    override fun checkServerTrusted(chain: Array<out X509Certificate>?, authType: String?) {}
    override fun getAcceptedIssuers(): Array<X509Certificate> = emptyArray()
}

// 构建TLS 1.2的SSL上下文
val sslContext = SSLContext.getInstance("TLSv1.2")
sslContext.init(null, null, null)

// 创建仅支持TLS 1.2的连接规格
val tls12ConnectionSpec = ConnectionSpec.Builder(ConnectionSpec.MODERN_TLS)
    .tlsVersions(TlsVersion.TLS_1_2)
    .build()

2. 配置并构建OkHttpClient #

val okHttpClient = OkHttpClient.Builder()
    // 优先使用TLS 1.2，同时保留明文连接用于调试（上线时请移除ConnectionSpec.CLEARTEXT）
    .connectionSpecs(listOf(tls12ConnectionSpec, ConnectionSpec.CLEARTEXT))
    .sslSocketFactory(sslContext.socketFactory, X509TrustManagerImpl())
    .build()

Java版本 #

1. 自定义TrustManager和配置SSL上下文 #

import okhttp3.ConnectionSpec;
import okhttp3.OkHttpClient;
import okhttp3.TlsVersion;
import java.security.SSLContext;
import java.security.cert.X509Certificate;
import javax.net.ssl.X509TrustManager;

public class X509TrustManagerImpl implements X509TrustManager {
    @Override
    public void checkClientTrusted(X509Certificate[] chain, String authType) {}

    @Override
    public void checkServerTrusted(X509Certificate[] chain, String authType) {}

    @Override
    public X509Certificate[] getAcceptedIssuers() {
        return new X509Certificate[0];
    }
}

// 构建SSL上下文
SSLContext sslContext = SSLContext.getInstance("TLSv1.2");
sslContext.init(null, null, null);

// 创建TLS 1.2连接规格
ConnectionSpec tls12ConnectionSpec = new ConnectionSpec.Builder(ConnectionSpec.MODERN_TLS)
        .tlsVersions(TlsVersion.TLS_1_2)
        .build();

2. 构建OkHttpClient #

OkHttpClient okHttpClient = new OkHttpClient.Builder()
        .connectionSpecs(Arrays.asList(tls12ConnectionSpec, ConnectionSpec.CLEARTEXT))
        .sslSocketFactory(sslContext.getSocketFactory(), new X509TrustManagerImpl())
        .build();

• 证书验证：上面的X509TrustManagerImpl是跳过证书验证的示例，上线环境绝对不能用！正确的做法是使用系统默认的TrustManager来验证服务器证书，代码如下：

val trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm())
trustManagerFactory.init(null as KeyStore?)
val trustManagers = trustManagerFactory.trustManagers
val x509TrustManager = trustManagers[0] as X509TrustManager

然后把这个x509TrustManager传给sslSocketFactory即可。

• 明文连接：ConnectionSpec.CLEARTEXT仅用于本地调试，正式发布时一定要移除，避免明文传输带来的安全风险。

这样配置后，你的OkHttpClient就会强制使用TLS 1.2与REST服务建立连接，完全适配SDK 24的环境。

内容的提问来源于stack exchange，提问作者Waqar Sadiq